CVE-2026-33208

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently executed on a remote managed server via SSH. An authenticated attacker can inject arbitrary shell metacharacters to break out of the intended grep command context and execute arbitrary OS commands with sudo privileges on the target server, resulting in full Remote Code Execution (RCE). Version 8.2.6.4 patches the issue.

• CWE-78

• https://github.com/roxy-wi/roxy-wi/commit/02f147d567a3cc8cf61a4b58ea4c2b7866a544dePatch
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2Exploit, Vendor Advisory
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2Exploit, Vendor Advisory

Published

Apr 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33202Active Storage allows users to attach cloud and local files …9.1
• CVE-2026-33203SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-33204SimpleJWT is a simple JSON web token library written in PHP.…7.5
• CVE-2026-33205calibre is a cross-platform e-book manager for viewing, conv…5.5
• CVE-2026-33206calibre is a cross-platform e-book manager for viewing, conv…6.3
• CVE-2026-33207DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33209Avo is a framework to create admin panels for Ruby on Rails …6.1
• CVE-2026-3321A vulnerability of authorization bypass through user-control…8.7
• CVE-2026-33210Ruby JSON is a JSON implementation for Ruby. From version 2.…9.1
• CVE-2026-33211Tekton Pipelines project provides k8s-style resources for de…9.6
• CVE-2026-33212Weblate is a web based localization tool. In versions prior …3.1
• CVE-2026-33213Redash is a package for data visualization and sharing. From…6.1