CVE-2026-45565: Roxy-WI Path Traversal Vulnerability

CVE-2026-45565 Overview

Roxy-WI is a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. CVE-2026-45565 affects versions 8.2.6.4 and prior, where the centralized Pydantic validator EscapedString fails to enforce directory traversal blocking when shell metacharacters are present. The validator located in app/modules/roxywi/class_models.py:16-30 is applied to dozens of fields including SSH credential name, username, and description. An attacker with low-privileged authenticated access can bypass input sanitization to inject path traversal sequences combined with shell metacharacters.

Critical Impact
Authenticated attackers can route .. payloads through the metacharacter-strip branch of EscapedString, evading directory traversal protection. The resulting value is not passed through shlex.quote(), exposing downstream command execution paths to injection.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
HAProxy, Nginx, Apache, and Keepalived management interfaces served by Roxy-WI
SSH credential management and related configuration fields validated by EscapedString

Discovery Timeline

2026-06-10 - CVE-2026-45565 published to the National Vulnerability Database
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45565

Vulnerability Analysis

The vulnerability resides in the EscapedString Pydantic validator at app/modules/roxywi/class_models.py:16-30. This validator serves as the centralized input sanitization layer for dozens of fields across Roxy-WI, including SSH credential names, usernames, and descriptions. The validator uses an if/elif/elif/else control flow to evaluate input strings.

When input contains a shell metacharacter such as ;, &, |, $, or a backtick, execution enters the metacharacter-stripping branch. That branch removes the offending characters and returns the cleaned value. However, it does not also enforce the .. directory traversal block that other branches apply. The returned string is not wrapped in shlex.quote() either, leaving downstream consumers exposed to both path traversal and shell-context injection.

This weakness is classified as Improper Input Validation [CWE-20]. The attack requires authentication but no user interaction, and the impact spans confidentiality and integrity of the managed proxy and load balancer infrastructure.

Root Cause

The root cause is incomplete validation logic. The if/elif/elif/else structure treats traversal filtering and metacharacter filtering as mutually exclusive paths rather than enforcing both. Appending a single metacharacter to a .. payload diverts execution into the strip branch, where the traversal sequence survives unfiltered. The absence of shlex.quote() on the returned value compounds the issue when the field is later interpolated into shell commands.

Attack Vector

An authenticated attacker submits a value such as ../../etc/passwd; into any field validated by EscapedString. The trailing ; triggers the metacharacter-strip arm, which removes the semicolon but leaves ../../etc/passwd intact. Backticks, $, |, and & produce equivalent bypasses. Because the result is not shell-quoted, downstream code that builds command strings from these fields can execute attacker-controlled traversal or command fragments. Refer to the GitHub Security Advisory GHSA-7qm8-cm8p-9rx3 for technical details.

Detection Methods for CVE-2026-45565

Indicators of Compromise

Roxy-WI request payloads containing .. sequences combined with trailing or embedded ;, &, |, $, or backtick characters
Unexpected file access patterns under directories adjacent to Roxy-WI working paths, including /etc/, /root/, and SSH key storage locations
Anomalous SSH credential or configuration entries containing path traversal fragments

Detection Strategies

Inspect HTTP request bodies and query parameters to Roxy-WI endpoints for the regex pattern \.\.[/\\].*[;&|$\]` or its reverse ordering
Audit Roxy-WI database fields validated by EscapedString for stored values containing .. segments
Correlate authenticated Roxy-WI sessions with downstream shell command executions referencing unexpected file paths

Monitoring Recommendations

Enable verbose application logging for all field updates handled by EscapedString and review for traversal artifacts
Forward Roxy-WI access logs and host process telemetry to a centralized analytics platform for cross-correlation
Alert on new or modified SSH credential records originating from non-administrative user accounts

How to Mitigate CVE-2026-45565

Immediate Actions Required

Restrict network access to Roxy-WI management interfaces to trusted administrative networks only
Audit existing user accounts and revoke unnecessary low-privileged access that could be used to reach validated input fields
Review SSH credential entries and configuration records for stored traversal payloads and remediate any tampered values

Patch Information

At the time of publication, no official patch is available from the Roxy-WI maintainers. Monitor the Roxy-WI GitHub Security Advisory GHSA-7qm8-cm8p-9rx3 for release updates and apply fixes as soon as they are published.

Workarounds

Place Roxy-WI behind a reverse proxy or web application firewall configured to block request payloads containing .. combined with shell metacharacters
Disable or restrict the affected Roxy-WI features that accept free-form fields such as SSH credential names and descriptions until a patch is applied
Run Roxy-WI under a dedicated low-privilege system account with filesystem access limited to required directories

bash

# Example WAF rule fragment to block traversal combined with shell metacharacters
SecRule ARGS "@rx \.\..*[;&|\$\\x60]|[;&|\$\\x60].*\.\." \
    "id:1026045565,phase:2,deny,status:403,msg:'Roxy-WI CVE-2026-45565 traversal+metachar bypass attempt'"