CVE-2026-45564 Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)
Authenticated low-privilege users can execute arbitrary commands via the configver URL parameter in Roxy-WI.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45564?
CVE-2026-45564 is a high-severity command injection vulnerability in roxy-wi, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/<service>/<server_ip>/<configver>/save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn't validate path segments declared as str) and the surrounding .. block is the broken tuple-membership patch from GHSA-vapt-004. An authenticated user with role <= 3 ("user") therefore reaches a bin/sh -c command-injection sink. At time of publication, there are no publicly available patches.
Weakness: CWE-78
Which versions are affected by CVE-2026-45564?
How do I fix CVE-2026-45564?
No fix has been published for CVE-2026-45564 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-45564 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45564 exists.
Sources
Also known as GHSA-w42x-3v8j-cmg2.