Path Traversal Vulnerability in Roxy-WI Web Interface for HAProxy and Nginx

CVE-2026-45569

What is CVE-2026-45569?

Roxy-WI, a web management interface for HAProxy and Nginx, contains a path traversal vulnerability that affects versions 8.2.6.4 and prior. Due to a flaw in the validation logic, the application allows the use of path traversal payloads such as '../../etc/passwd', which can potentially expose sensitive system files. The vulnerability arises when the validation checks only for literal string matches instead of proper containment checks. As a consequence, malicious users can exploit this weakness to bypass intended security measures and access unauthorized data. As of the time of this writing, there are no publicly available patches to address this issue.

References