CVE-2026-27811CWE-77CWE-78

Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE

High · published March 17, 2026

CVSS v3.1
8.8
EPSS
3%
Percentile
87.8
In the wild
Unconfirmed
What it is

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare/<service>/<server_ip>/show` endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in `app/modules/config/config.py` on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03132 · 87.8th percentile
Weaknesses
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-17T23:43Z
EPSS history
Timeline
  • 17 MAR 23:43Z
    Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE
    cvelistv5