CVE-2026-33431

The record

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.

Affected packages

Related vulnerabilities

• CVE-2026-14947 A high-privileged remote attacker can upload malicious ZIP archive containing directory… CWE-24
• CVE-2026-76353 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-24
• CVE-2026-73573 In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in… CWE-24
• CVE-2026-66140 Exim before 4.99.5 allows directory traversal to access files outside of the spool area… CWE-24
• CVE-2026-44942 A path traversal in handling the "path" component of .repo files processed by libzypp… CWE-24
• CVE-2026-49103 Webmin before 2.640 does not safely construct a filename for saving of an attachment… CWE-24
• CVE-2026-48047 XWiki Platform vulnerable to potential arbitrary file writing using path traversal from… CWE-24
• CVE-2026-22810 Joplin is an open source note-taking and to-do application that organises notes and lists… CWE-24