# CVE-2026-33431

## Summary

- **CVE ID:** CVE-2026-33431
- **Severity:** MEDIUM
- **CVSS Score:** 5.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P)
- **CWE:** CWE-24
- **Published:** Apr 20, 2026
- **Last Modified:** Apr 21, 2026

## Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is directly appended to a base directory path to construct a local file path, which is subsequently opened and its contents returned to the caller. The existing path traversal guard only inspects the base directory variable (which is never user-controlled) and entirely ignores the user-supplied configver value. An authenticated attacker can supply a configver value containing `../` sequences to escape the intended directory and read arbitrary files accessible to the web application process. Version 8.2.6.4 contains a patch for the issue.

## Affected Products

- roxy-wi — roxy-wi (< 8.2.6.4)

## References

- [CNA](https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-w3c9-36jf-qrw4)
- [CNA](https://github.com/roxy-wi/roxy-wi/commit/d4d100067dd0ee04317f05d3b51be8fcfdc3f802)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.39%
- **EPSS Percentile:** 32.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._