CVE-2026-27811
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers.
Published Mar 18, 2026 · updated Jun 17, 2026 · roxy-wi roxy-wi
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 18, 2026 · NIST NVD
Detected
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3
Jun 17, 2026 · NIST NVD
Updated
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3
Affected
- cpe roxy-wi/roxy-wiversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-27811
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-27811
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the endpoint, allowed authenticated users to execute arbitrary system commands
nvd.nist.gov