CVE-2026-45569: Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

Synopsis

A path-traversal vulnerability exists in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers, affecting versions 8.2.6.4 and prior. The flaw stems from a defective security patch: the check `'..' in (a, b, c)` tests tuple membership rather than substring containment, meaning any real path-traversal payload (such as `../../etc/passwd`) bypasses the guard silently. An authenticated attacker reachable over the network can read arbitrary files on the host and tamper with configuration data. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Roxy-WI web interface over the network; the service must be accessible from the attacker's position (AV:N).

• AuthenticationRequired

  A valid low-privilege account is sufficient; no administrator or elevated credentials are needed to trigger the path-traversal (PR:L).

• Victim interactionNot required

  No victim action such as clicking a link or opening a file is needed; the attacker sends the malicious request directly (UI:N).

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory-layout dependencies, or special environmental state are required (AC:L).

Blast Radius

• An attacker reads arbitrary files accessible to the Roxy-WI process, including configuration files, credentials, private keys, and secrets stored on the host filesystem.
• An attacker writes or overwrites configuration files for managed services (HAProxy, Nginx, Apache, Keepalived), potentially altering routing rules, access controls, or TLS settings across the managed fleet.
• Manipulated service configurations can be used to redirect traffic, disable TLS verification, or introduce backdoor listener rules into managed load balancers and web servers.