CVE-2026-33431 Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer

Medium 5.7 Published 20 Apr 2026 Updated 21 Apr 2026

An authenticated attacker can read arbitrary files on the server by exploiting a path traversal vulnerability in the config version viewer.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-33431?

CVE-2026-33431 is a medium-severity path traversal vulnerability in roxy-wi, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.

Weakness: CWE-24

Which versions are affected by CVE-2026-33431?

It affects 1 product.

Products include Roxy-Wi Roxy-Wi.

How do I fix CVE-2026-33431?

No fix has been published for CVE-2026-33431 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-33431 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33431 exists.

Sources

Also known as GHSA-w3c9-36jf-qrw4.