CVE-2026-45569 Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)
A flawed security patch in Roxy-WI fails to block path traversal, allowing attackers to read arbitrary files from the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-45569?
CVE-2026-45569 is a high-severity path traversal vulnerability in roxy-wi, published on 10 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config_file_name and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to the literal string '..'. For any realistic path-traversal payload (../../etc/passwd, ..\\..\\etc\\passwd, etc.) the check returns False and the patch silently lets the payload through. At time of publication, there are no publicly available patches.
Which versions are affected by CVE-2026-45569?
How do I fix CVE-2026-45569?
No fix has been published for CVE-2026-45569 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-45569 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45569 exists.
Sources
Also known as GHSA-j6p4-8532-h9hv.