CVE-2026-45564: Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save)

Synopsis

Authenticated remote code execution (RCE) via OS command injection in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The vulnerability is reachable over the network by any authenticated user holding a low-privilege role (role 3 or below); the configver URL path parameter is passed unsanitized into an os.system() call, giving an attacker a direct shell command injection sink. Successful exploitation gives the attacker full control over the host: arbitrary command execution, access to all data the process can read, and the ability to modify or destroy configuration and state. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Roxy-WI web interface must be reachable over the network; an attacker sends a crafted HTTP POST request to the vulnerable endpoint from any network-accessible client.

• AuthenticationRequired

  A valid account with role 3 (standard user) or lower is sufficient; no administrative or elevated privileges are needed beyond basic login.

• Victim interactionNot required

  The attacker sends the malicious request directly to the server; no action by another user or administrator is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or special environmental state is required to trigger the command injection.

Blast Radius

• Executes arbitrary operating system commands under the process identity of the Roxy-WI service, giving the attacker a remote shell on the host.
• Reads all files accessible to the service process, including stored HAProxy, Nginx, Apache, and Keepalived configuration files, secrets, and credentials.
• Modifies or overwrites server configuration files, allowing silent reconfiguration of load balancers and proxies managed through the interface.
• Crashes or disrupts the Roxy-WI service and any managed backend services by corrupting configuration state or terminating processes.