CVE-2026-33077: Roxy-wi Path Traversal Vulnerability

CVE-2026-33077 Overview

CVE-2026-33077 is a Path Traversal vulnerability affecting Roxy-WI, a popular web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The vulnerability exists in the oldconfig parameter within the haproxy_section_save interface, allowing unauthenticated attackers to read arbitrary files from the server's file system.

Critical Impact
This arbitrary file read vulnerability enables attackers to access sensitive configuration files, credentials, private keys, and other confidential data stored on systems running vulnerable versions of Roxy-WI.

Affected Products

Roxy-WI versions prior to 8.2.6.4
Systems using Roxy-WI to manage Haproxy, Nginx, Apache, and Keepalived servers
All deployments with network-accessible Roxy-WI web interfaces

Discovery Timeline

2026-04-24 - CVE CVE-2026-33077 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-33077

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Path Traversal), a weakness that occurs when software uses external input to construct a pathname for a restricted directory, but fails to properly neutralize special elements within the pathname. In the case of CVE-2026-33077, the oldconfig parameter in the haproxy_section_save endpoint does not adequately validate user-supplied input, allowing attackers to traverse directory structures using sequences such as ../ to access files outside the intended directory.

The network-based attack vector requires no authentication or user interaction, making this vulnerability particularly dangerous for internet-exposed Roxy-WI installations. An attacker can exploit this flaw to read sensitive system files including /etc/passwd, /etc/shadow (if permissions allow), application configuration files containing database credentials, SSL certificates, and private keys used by the managed services.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of the oldconfig parameter before it is used in file system operations. The application failed to implement proper path canonicalization and boundary checks, allowing directory traversal sequences to escape the intended configuration file directory.

Attack Vector

The vulnerability is exploited through network-based requests to the Roxy-WI web interface. An attacker can craft malicious HTTP requests to the haproxy_section_save endpoint with a manipulated oldconfig parameter containing path traversal sequences. Since the vulnerability requires no authentication or privileges, any network user with access to the Roxy-WI interface can potentially exploit it.

The attack flow typically involves:

Identifying a vulnerable Roxy-WI instance accessible over the network
Crafting a request to the haproxy_section_save endpoint with traversal sequences in the oldconfig parameter
Retrieving sensitive file contents from arbitrary locations on the server's file system

Detection Methods for CVE-2026-33077

Indicators of Compromise

Unusual HTTP requests to the haproxy_section_save endpoint containing path traversal patterns (../, ..%2f, %2e%2e/)
Web server logs showing repeated access to configuration endpoints with abnormal parameter values
Unexpected file access events in system audit logs, particularly for sensitive files like /etc/passwd, /etc/shadow, or application credential files
Network traffic analysis revealing responses containing system file contents from the Roxy-WI application

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP parameters
Configure intrusion detection systems (IDS) to alert on requests containing directory traversal sequences targeting the Roxy-WI application
Deploy endpoint detection and response (EDR) solutions to monitor file system access from web application processes
Enable detailed logging on Roxy-WI and correlate with SIEM for anomaly detection

Monitoring Recommendations

Monitor web server access logs for suspicious patterns in the oldconfig parameter of requests to haproxy_section_save
Set up alerts for file access attempts outside the normal Roxy-WI configuration directories
Implement network monitoring for data exfiltration indicators following potential exploitation
Regularly audit Roxy-WI access logs and correlate with known attack patterns

How to Mitigate CVE-2026-33077

Immediate Actions Required

Upgrade Roxy-WI to version 8.2.6.4 or later immediately
If immediate patching is not possible, restrict network access to the Roxy-WI interface using firewall rules
Review web server logs for evidence of exploitation attempts
Audit sensitive files on systems running vulnerable versions for unauthorized access

Patch Information

The Roxy-WI development team has addressed this vulnerability in version 8.2.6.4. The fix includes improved input validation and IP/DNS validation in routes. The security patch can be reviewed at the GitHub Commit Changes. Full details are available in the GitHub Security Advisory GHSA-c799.

The patch introduces additional common module imports for improved validation:

python

 import app.modules.db.sql as sql
+import app.modules.common.common as common
 import app.modules.roxy_wi_tools as roxy_wi_tools
 
 get_config_var = roxy_wi_tools.GetConfigVar()

Source: GitHub Commit

Workarounds

Restrict access to the Roxy-WI web interface to trusted networks only using firewall rules or network segmentation
Implement a reverse proxy with WAF capabilities in front of Roxy-WI to filter malicious requests
Disable or restrict access to the haproxy_section_save endpoint if not required for operations
Apply principle of least privilege to the Roxy-WI application service account to limit file system access

bash

# Configuration example - Restrict Roxy-WI access via iptables
# Allow access only from trusted management network
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP