Cloudanix VulnDB

CVE-2026-45559

Medium · 4.9

CVSS

4.9

EPSS

0.2%

Published

Jun 10, 2026

CISA due date

—

The record

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim — no checkAjaxInput, no LDAP escape — and inserted, a username like *)(mail=*)(cn=* injects additional clauses, allowing the admin to enumerate or harvest attributes outside the intended record. At time of publication, there are no publicly available patches.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities