CVE-2026-45569: Roxy-WI Path Traversal Vulnerability

CVE-2026-45569 Overview

CVE-2026-45569 is a path traversal vulnerability [CWE-22] in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions 8.2.6.4 and prior contain a flawed validation routine introduced in commit d4d10006. The patch attempted to block .. sequences in the config_file_name and configver parameters but used Python tuple-membership instead of substring containment. As a result, realistic path-traversal payloads such as ../../etc/passwd bypass the check entirely. Authenticated attackers can leverage this flaw to read or manipulate files outside the intended configuration directory.

Critical Impact
Authenticated attackers can bypass the path-traversal validation in Roxy-WI to access arbitrary configuration files, compromising the confidentiality and integrity of managed Haproxy, Nginx, Apache, and Keepalived deployments.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
The vulnerable code resides in app/modules/config/config.py:462
All deployments managing Haproxy, Nginx, Apache, or Keepalived through the affected web interface

Discovery Timeline

2026-06-10 - CVE-2026-45569 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45569

Vulnerability Analysis

The flaw exists in the input validation logic for the config_file_name and configver parameters in app/modules/config/config.py. The maintainers introduced a check intended to reject any value containing .. as a defense against directory traversal. The patch instead evaluates whether the literal string .. equals any element in a tuple of three variables. Because user-supplied traversal payloads contain .. as a substring rather than as the entire value, the comparison returns False and execution continues. Attackers retain the ability to traverse the filesystem from the configuration directory.

Exploitation requires authentication, as reflected in the PR:L component of the score. Successful attacks compromise confidentiality and integrity but do not affect availability.

Root Cause

The root cause is a misuse of Python's in operator. '..' in (a, b, c) performs tuple-membership comparison, returning True only when one of a, b, or c equals exactly the string ... The intended substring check would have been any('..' in x for x in (a, b, c)). The maintainer's commit message indicates the goal was to expand validation, but the implementation silently fails open.

Attack Vector

An authenticated attacker submits a request to a configuration endpoint with a crafted config_file_name or configver value containing traversal sequences such as ../../etc/passwd or ..\\..\\etc\\passwd. The validation routine accepts the payload, and downstream file operations resolve the path outside the intended directory. The attacker reads sensitive files or writes to arbitrary locations the Roxy-WI process can access.

python

 	else:
 		config_file_name = ''
 
-	if '..' in configs_dir:
+	if '..' in (configs_dir, config_file_name, configver):
 		raise Exception('error: nice try')
 
 	if configver is None:

Source: GitHub Commit d4d10006 — This patch attempted to add config_file_name and configver to the existing .. check but introduced the tuple-membership bug described above.

Detection Methods for CVE-2026-45569

Indicators of Compromise

HTTP requests to Roxy-WI configuration endpoints containing .., %2e%2e, or ..\\ sequences in the config_file_name or configver parameters
Web server access logs showing requests for sensitive system paths such as /etc/passwd, /etc/shadow, or SSH key locations referenced through the Roxy-WI interface
Roxy-WI process accessing files outside its expected configuration directory tree

Detection Strategies

Inspect application logs and reverse-proxy logs for parameter values containing .. or URL-encoded variants targeting config_file_name and configver
Deploy a Web Application Firewall (WAF) rule that blocks path-traversal patterns on Roxy-WI endpoints
Audit filesystem reads performed by the Roxy-WI service account using auditd or eBPF-based monitoring to identify access outside /etc/roxy-wi or the configured directory

Monitoring Recommendations

Forward Roxy-WI application logs and host audit events to a centralized SIEM for correlation
Alert on authenticated sessions that submit multiple requests containing traversal sequences within a short window
Track outbound file reads from the Roxy-WI process against an allowlist of expected configuration paths

How to Mitigate CVE-2026-45569

Immediate Actions Required

Restrict network access to the Roxy-WI web interface to trusted management networks until a patched release is available
Rotate credentials for any accounts that can authenticate to Roxy-WI and enforce strong, unique passwords
Review historical logs for evidence of traversal attempts against config_file_name and configver

Patch Information

At the time of publication, there are no publicly available patches that correctly address the flaw. The commit d4d10006 referenced in the GitHub Security Advisory GHSA-j6p4-8532-h9hv introduces the broken check rather than fixing it. Monitor the Roxy-WI repository for an updated release that replaces tuple-membership with a substring check such as any('..' in v for v in (configs_dir, config_file_name, configver)).

Workarounds

Place Roxy-WI behind a reverse proxy that blocks requests containing .., %2e%2e, or backslash-encoded traversal sequences on configuration endpoints
Run the Roxy-WI service under a dedicated low-privilege user with filesystem permissions restricted to the configuration directory
Apply mandatory access controls such as AppArmor or SELinux profiles to confine the Roxy-WI process to its expected file paths

bash

# Example NGINX reverse-proxy rule to block traversal payloads
location /config/ {
    if ($args ~* "(\.\.|%2e%2e|\.\.\\)") {
        return 403;
    }
    proxy_pass http://roxy_wi_backend;
}