CVE-2026-22265: Roxy-WI Command Injection Vulnerability

CVE-2026-22265 Overview

CVE-2026-22265 is a command injection vulnerability in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Prior to version 8.2.8.2, a command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is located in app/modules/roxywi/logs.py at line 87, where the grep parameter is used twice—once sanitized and once raw—enabling attackers to bypass input validation and execute malicious commands on the underlying system.

Critical Impact

Authenticated attackers can execute arbitrary system commands on servers running vulnerable Roxy-WI installations, potentially leading to full server compromise, data exfiltration, or lateral movement within managed infrastructure.

Affected Products

• Roxy-WI versions prior to 8.2.8.2
• Web interfaces managing Haproxy, Nginx, Apache, and Keepalived servers
• Systems exposing the Roxy-WI log viewing functionality to authenticated users

Discovery Timeline

• 2026-01-15 - CVE CVE-2026-22265 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-22265

Vulnerability Analysis

This command injection vulnerability (CWE-78) stems from inconsistent input sanitization in the log viewing functionality. The vulnerable code path processes user-supplied input through the grep parameter, which is used in two different contexts within the same function—one instance properly sanitized and one used in its raw form. This dual-use pattern creates a dangerous gap where attackers can craft payloads that pass initial validation but are executed without sanitization in the second usage context.

The vulnerability requires authentication, meaning attackers must have valid credentials to access the Roxy-WI interface. However, once authenticated, even low-privileged users can exploit this flaw to execute commands with the privileges of the web application process, which typically has elevated access to manage server configurations.

Root Cause

The root cause is improper input validation where the grep parameter in app/modules/roxywi/logs.py at line 87 is sanitized inconsistently. The original input sanitization pattern failed to account for several dangerous characters that could be used for command injection, including newline characters (\n, \r) and redirection operators (<, >). The fix expanded the character blocklist to prevent these injection vectors.

Attack Vector

The attack vector is network-based, requiring authenticated access to the Roxy-WI web interface. An attacker with valid credentials can submit a malicious grep parameter containing command injection payloads through the log viewing functionality. The payload bypasses sanitization on its second use within the code, allowing arbitrary command execution on the host system.

# Security patch showing the input sanitization fix
# Source: https://github.com/roxy-wi/roxy-wi/commit/f040d3338c4ba6f66127487361592e32e0188eee

 	:return: The modified `ajax_input` string, or an empty string if the input was empty or contained non-permitted characters.
 	"""
 	if not ajax_input: return ''
-	pattern = re.compile('[&;|$`]')
+	pattern = re.compile('[&;|$`\n\r<>]')
 	if pattern.search(ajax_input):
 		raise ValueError('Error: Non-permitted characters detected')
 	else:

The patch expands the regex pattern to include newline characters (\n, \r) and redirection operators (<, >) that were previously permitted and could be abused for command injection.

Detection Methods for CVE-2026-22265

Indicators of Compromise

• Unusual command execution patterns originating from the Roxy-WI web application process
• Log entries containing shell metacharacters or encoded injection payloads in grep parameters
• Unexpected outbound network connections from servers hosting Roxy-WI
• Process spawning anomalies where the web server process creates unexpected child processes

Detection Strategies

• Monitor web application logs for requests to log viewing endpoints containing suspicious characters such as newlines, backticks, or shell operators
• Implement anomaly detection for command execution patterns from the Roxy-WI application context
• Deploy web application firewalls (WAF) with rules to detect command injection attempts in query parameters
• Enable process monitoring to alert on unexpected process trees spawned by the web server

Monitoring Recommendations

• Configure SIEM rules to correlate authentication events with subsequent command injection indicators
• Establish baseline behavior for the Roxy-WI application and alert on deviations
• Monitor file system changes in sensitive directories that could indicate post-exploitation activity
• Review access logs for repeated attempts to access log viewing functionality with varying payloads

How to Mitigate CVE-2026-22265

Immediate Actions Required

• Upgrade Roxy-WI to version 8.2.8.2 or later immediately
• Review authentication logs for suspicious activity from accounts that accessed the log viewing functionality
• Audit user accounts with access to the Roxy-WI interface and remove unnecessary privileges
• Implement network segmentation to limit exposure of the Roxy-WI management interface

Patch Information

The vulnerability is fixed in Roxy-WI version 8.2.8.2. The security patch (commit f040d3338c4ba6f66127487361592e32e0188eee) improves input sanitization by expanding the character blocklist to include newline characters and redirection operators. Organizations should upgrade to the patched version available at the GitHub Release v8.2.8.2. For additional details, refer to the GitHub Security Advisory GHSA-mmmf-vh7m-rm47.

Workarounds

• Restrict access to the Roxy-WI interface to trusted networks only using firewall rules or VPN requirements
• Implement additional WAF rules to filter requests containing command injection patterns
• Disable or restrict access to the log viewing functionality until patching is completed
• Enable enhanced logging and monitoring on systems running Roxy-WI to detect exploitation attempts

# Example: Restrict Roxy-WI access to trusted networks using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP