CVE-2026-33076 HIGH

CVE-2026-33076: Roxy-WI vulnerable to path traversal and arbitrary file writing

Vendor Roxy-Wi
Product roxy-wi
Weakness CWE-22 · Path traversal
Published April 24, 2026
Last update April 24, 2026
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the haproxy_section_save interface presents a vulnerability that could lead to remote code execution due to path traversal and writing into scheduled tasks. Version 8.2.6.4 fixes the issue.

Key dates

02Disclosure timeline

April 24, 2026 CVE published
April 24, 2026 Record updated