CVE-2026-33431

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.

• CWE-24

• https://github.com/roxy-wi/roxy-wi/commit/d4d100067dd0ee04317f05d3b51be8fcfdc3f802Patch
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4Exploit, Vendor Advisory
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4Exploit, Vendor Advisory

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33426Discourse is an open-source discussion platform. Prior to ve…3.8
• CVE-2026-33427Discourse is an open-source discussion platform. Prior to ve…7.5
• CVE-2026-33428Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2026-33429Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-3343A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2026-33430Briefcase is a tool for converting a Python project into a s…7.3
• CVE-2026-33432Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.1
• CVE-2026-33433Traefik is an HTTP reverse proxy and load balancer. Prior to…8.8
• CVE-2026-33434Wazuh is a free and open source platform used for threat pre…7.1
• CVE-2026-33435Weblate is a web based localization tool. In versions prior …8
• CVE-2026-33436Stirling-PDF is a locally hosted web application that facili…6.1
• CVE-2026-33438Stirling-PDF is a locally hosted web application that allows…6.5