Vulnerability record · CVE-2026-33208 · published 24 April 2026

CVE-2026-33208: Roxy-wi os command injection vulnerability

Roxy Wi · Roxy Wi

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the /config/ < service > /find-in-config endpoint in Roxy-WI fails to sanitize the user-supplied words parameter before embedding it into a shell command string that is subsequently executed on a remote managed server via SSH. An authenticated attacker can inject arbitrary shell metacharacters to break out of the intended grep command context and execute arbitrary OS commands with sudo privileges on the target server, resulting in full Remote Code Execution (RCE). Version 8.2.6.4 patches the issue.

7.4 CVSS 4.0 High EPSS 0.91% · top 41.8% CWE-78 · OS command injection

7.4CVSS 4.0 base score

0.91%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Roxy Wi Roxy Wi

References

Link	Tags
https://github.com/roxy-wi/roxy-wi/commit/02f147d567a3cc8cf61a4b58ea4c2b7866a544de	Patch
https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2	ExploitVendor Advisory
https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-7m2h-gmvj-cjx2	ExploitVendor Advisory

Track CVE-2026-33208 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-31161Roxy-wi command injection vulnerabilityRoxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via t…EPSS 28%15 Jul 2022 9.8CVE-2022-31137Roxy-WI unauthenticated OS command injection in options.pyRoxy-WI versions before 6.1.1.0 pass user-supplied input into the subprocess_execute function in /app/options.py without sanitisation, allowing OS co…EPSS 91%analysed8 Jul 2022 9.8CVE-2022-31125Roxy-wi improper authentication vulnerabilityRoxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unaut…EPSS 20%6 Jul 2022 9.8CVE-2022-31126Roxy-wi unauthenticated remote code execution via options.py injectionRoxy-wi, an open source web interface for managing HAProxy, Nginx, Apache and Keepalived, contains an injection flaw (CWE-74) in /app/options.py. A r…EPSS 53%analysed6 Jul 2022 9.8CVE-2021-38167Roxy-wi sql injection vulnerabilityRoxy-WI through 5.2.2.0 allows SQL Injection via check_login. An unauthenticated attacker can extract a valid uuid to bypass authentication.EPSS 1.3%7 Aug 2021 8.9CVE-2026-33076Roxy-wi path traversal vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface p…EPSS 1.0%24 Apr 2026 8.9CVE-2026-33078Roxy-wi sql injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability i…EPSS 0.52%24 Apr 2026 8.8CVE-2026-27811Roxy-wi command injection vulnerabilityRoxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability ex…EPSS 3.0%18 Mar 2026

Source: NIST National Vulnerability Database (record CVE-2026-33208), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.