What’s Vulnerable › Vulnerabilities

CVE-2026-22265: Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-15 · updated 2026-06-17
• Weakness: CWE-78

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line 87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.

Affected products

• roxy-wi: before 8.2.8.2 — fixed in 8.2.8.2

How to fix

Upgrade to a fixed version: roxy-wi 8.2.8.2. Check the vendor advisory for mitigations.

References

• https://github.com/roxy-wi/roxy-wi/commit/f040d3338c4ba6f66127487361592e32e0188eee
• https://github.com/roxy-wi/roxy-wi/releases/tag/v8.2.8.2
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmmf-vh7m-rm47

Get alerted when CVE-2026-22265 or the next vulnerability affects your stack