Skip to content
OpenAdvisories
High · 8.9 CVE-2026-33076 EUVD-2026-25375

Roxy-WI vulnerable to path traversal and arbitrary file writing

Published Apr 24, 2026 · Updated Apr 24, 2026 · Assigned by GitHub_M

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issue.

Affected products

VendorProductAffectedFixed
roxy-wi roxy-wi < 8.2.6.4 —

References