CVE-2026-45565: Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)

Synopsis

A path-traversal and remote code execution vulnerability exists in Roxy-WI, a web management interface for HAProxy, Nginx, Apache, and Keepalived servers. The flaw is reachable over the network by any authenticated low-privilege user, with no victim interaction required, because the centralized EscapedString Pydantic validator in class_models.py routes crafted input through a metacharacter-stripping branch that leaves directory-traversal sequences intact and unquoted. Successful exploitation allows an attacker to read sensitive files from the host or execute arbitrary commands, resulting in full confidentiality and integrity compromise of the underlying system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Roxy-WI web interface over the network; the service is exposed via HTTP/HTTPS and no local or physical access is assumed.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker must be authenticated to the Roxy-WI interface but does not need administrative rights.

• Victim interactionNot required

  No victim interaction is needed; the attacker submits a crafted payload directly to the vulnerable API fields without requiring any other user to take action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, memory-layout knowledge, or other environmental preconditions beyond a valid low-privilege session.

Blast Radius

• Reads arbitrary files from the host filesystem, including SSH private keys, configuration files with embedded credentials, and OS-level secrets reachable through the traversal path.
• Executes arbitrary shell commands on the server running Roxy-WI by injecting payloads through the unquoted, traversal-surviving EscapedString output passed to shell invocations.
• Modifies or overwrites server-side configuration files for HAProxy, Nginx, Apache, or Keepalived, disrupting or redirecting proxied traffic.
• Pivots laterally to backend infrastructure servers whose SSH credentials are stored within Roxy-WI, given the attacker can read and exfiltrate those credentials.