Roxy-WI Path Traversal Enables Arbitrary Command Execution

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions/<service>/<server_ip>/<configver>/save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn't validate path segments declared as str) and the surrounding .. block is the broken tuple-membership patch from GHSA-vapt-004. An authenticated user with role <= 3 ("user") therefore reaches a bin/sh -c command-injection sink. At time of publication, there are no publicly available patches.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Roxy-WI, a web interface for managing critical infrastructure services like HAProxy, Nginx, Apache, and Keepalived, contains a command injection vulnerability in its configuration version management endpoint. Versions 8.2.6.4 and prior fail to sanitize the configver URL parameter before passing it to os.system(), allowing attackers to inject arbitrary shell commands through path traversal sequences. This is particularly critical because Roxy-WI typically runs with elevated privileges to manage production load balancers and reverse proxies—infrastructure that directly impacts application availability and data flow. Any unauthenticated or low-privileged attacker who can reach the vulnerable endpoint can achieve remote code execution on the underlying server, making this a high-severity threat to organizations managing their network infrastructure through this tool.

Casky's 419 mapped skills detect this attack pattern across MITRE ATT&CK's initial access (TA0001), command and control (TA0043), and execution (TA0002) techniques. Practitioners using Casky would observe detection patterns for: unsanitized user input flowing into system command execution paths (CWE-78 detection), suspicious POST requests to /config/versions endpoints with encoded traversal sequences like ../ or shell metacharacters, process execution anomalies where dos2unix is spawned with unexpected arguments, and lateral movement indicators if the compromised Roxy-WI instance is leveraged to modify multiple load balancer configurations. Claude's extended reasoning capability maps these discrete indicators into a coherent attack narrative—identifying that a single malicious request can chain from initial access through command execution to potential persistence across managed infrastructure nodes.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45564.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-45564

Casky has 419 skills that investigate the attack patterns behind CVE-2026-45564. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn