CVE-2026-22265

216.73.217.64

· Published 15/01/2026 17:16 · Modified 16/01/2026 15:55

Labels: CVE-2026-22265 2026-01-15 CVE-2026-22265 CWE-78 [email protected]

Essential information

Published: 15/01/2026 17:16
Modified: 16/01/2026 15:55
Author: —
Creator: —
CVSS: 7.5 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS metrics

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line 87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
roxy-wi / roxy-wi	`cpe:2.3:a:roxy-wi:roxy-wi:<8.2.8.2:::::::*`
haproxy / haproxy	`cpe:2.3:a:haproxy:haproxy::::::::`
nginx / nginx	`cpe:2.3:a:nginx:nginx::::::::`
apache / apache	`cpe:2.3:a:apache:apache::::::::`
keepalived / keepalived	`cpe:2.3:a:keepalived:keepalived::::::::`