Command Injection Vulnerability in Roxy-WI Web Interface for Server Management

CVE-2026-45564

What is CVE-2026-45564?

Roxy-WI, a web interface designed for managing Haproxy, Nginx, Apache, and Keepalived servers, contains a vulnerability that allows an authenticated user with a role of 3 or lower to inject arbitrary commands. This occurs through improper handling of the configver parameter in the POST request to /config/versions//<server_ip>//save. The configver is directly interpolated into a command that is executed, allowing potential attackers to leverage this flaw to execute shell commands on the server. As of now, no patches are available, making it crucial for users to evaluate their security posture.

References