Skip to content
OpenAdvisories
High · 7.7 CVE-2026-33077 EUVD-2026-25376

Roxy-WI has an arbitrary file read vulnerability

Published Apr 24, 2026 · Updated Apr 25, 2026 · Assigned by GitHub_M

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.

Affected products

VendorProductAffectedFixed
roxy-wi roxy-wi < 8.2.6.4 —

References