SQL Injection Vulnerability in Roxy-WI Web Management Interface
CVE-2026-33078

8.9HIGH

Key Information:

Vendor

Roxy-wi

Status
Roxy-wi
Vendor
CVE Published:
24 April 2026

What is CVE-2026-33078?

Roxy-WI, a web interface designed for managing HAProxy, Nginx, Apache, and Keepalived servers, contains a SQL injection vulnerability in the haproxy_section_save function found in app/routes/config/routes.py. The vulnerability arises from the unsanitized handling of the server_ip parameter, which originates from the URL path. Due to a lack of proper input validation, this parameter is passed through multiple function calls and eventually interpolated into a SQL query string through Python's string formatting. This flaw allows attackers to execute arbitrary SQL commands, making it crucial for users of Roxy-WI to upgrade to version 8.2.6.4 or later to mitigate this risk.

Affected Version(s)

roxy-wi < 8.2.6.4

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092f...
x_refsource_MISC

CVSS V4

Score:
8.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.