216.73.217.22

CVE-2026-33431

· Published 20/04/2026 21:16 · Modified 21/04/2026 16:20

Labels: CVE-2026-33431 2026-04-20CVE-2026-33431CWE-24[email protected]

Essential information

Published
20/04/2026 21:16
Modified
21/04/2026 16:20
Author
Creator
CVSS
5.7 MEDIUM (v3) 5.7 MEDIUM (v4.0)
CISA KEV
No
CWE
CVSS vector

CVSS metrics

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.

NVD status

Status
Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
roxy-wi / roxy-wi cpe:2.3:a:roxy-wi:roxy-wi:<8.2.6.4:*:*:*:*:*:*:*
haproxy / haproxy cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
nginx / nginx cpe:2.3:a:nginx:nginx:*:*:*:*:*:*:*:*
apache / apache cpe:2.3:a:apache:apache:*:*:*:*:*:*:*:*
keepalived / keepalived cpe:2.3:a:keepalived:keepalived:*:*:*:*:*:*:*:*

References