Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

roxy-wi — Vulnerabilities & Security Advisories 32

All 32 CVE vulnerabilities found in roxy-wi, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability information for roxy-wi, categorized by weakness type and tagged for easy navigation. It collects known security flaws affecting the roxy-wi product, including recent disclosures and historical data spanning multiple years to provide a comprehensive view of its security posture over time. Here, you can track the vendor’s advisory history to stay informed about how security issues are addressed and resolved. You can also gain a deeper understanding of specific weakness classes by seeing how they manifest within this particular software environment. Additionally, the page allows you to look up the product’s complete vulnerability history, offering insights into recurring themes or persistent security challenges. This resource is designed to help developers, security analysts, and system administrators assess risk and prioritize mitigation efforts based on verified data rather than speculation. By centralizing this information, the page aims to reduce the time spent searching for details across multiple sources and enable faster, more informed decision-making. Whether you are conducting a routine security audit or investigating a specific threat, this aggregated view provides a structured foundation for understanding the security landscape surrounding roxy-wi. The content is regularly updated to reflect new findings and advisories, ensuring that the information remains relevant and actionable for all users interested in maintaining a secure deployment of this product.

Vendor: hap-wi

CVE ID Title CVSS Severity Published
CVE-2026-45569 Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug) CWE-22 8.1 High 2026-06-10
CVE-2026-45567 Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt CWE-287 8.3 High 2026-06-10
CVE-2026-45566 Roxy-WI: Open redirect on /login?next= via basic-auth userinfo syntax bypass CWE-601 6.1 Medium 2026-06-10
CVE-2026-45565 Roxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors) CWE-20 8.1 High 2026-06-10
CVE-2026-45564 Roxy-WI: Authenticated RCE via 'configver' URL parameter (os.system sink in /config/versions/.../save) CWE-78 8.8 High 2026-06-10
CVE-2026-45563 Roxy-WI: IDOR — any authenticated user can read another user's full action history CWE-639 4.3 Medium 2026-06-10
CVE-2026-45561 Roxy-WI: SSRF in /smon/agent/<endpoint>/<server_ip> reachable to cloud metadata IPs CWE-918 6.5 Medium 2026-06-10
CVE-2026-45560 Roxy-WI: Stored XSS in log viewer (wrap_line/highlight_word produce unescaped HTML) CWE-79 6.1 Medium 2026-06-10
CVE-2026-45559 Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only) CWE-90 4.9 Medium 2026-06-10
CVE-2026-45558 Roxy-WI: Authenticated RCE on every managed HAProxy load balancer via `option` field config injection in section save CWE-20 9.9 Critical 2026-06-10
CVE-2026-45556 Roxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name` CWE-20 9.9 Critical 2026-06-10
CVE-2026-45550 Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body CWE-639 9.1 Critical 2026-06-10
CVE-2026-45549 Roxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host CWE-862 8.5 High 2026-06-10
CVE-2026-45552 Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server CWE-639 9.9 Critical 2026-06-10
CVE-2026-33208 Roxy-WI Vulnerable to Authenticated Remote Code Execution via OS Command Injection in find-in-config Endpoint CWE-78 8.8AI High AI 2026-04-24
CVE-2026-33078 Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter CWE-89 9.8AI Critical AI 2026-04-24
CVE-2026-33077 Roxy-WI has an arbitrary file read vulnerability CWE-22 7.5AI High AI 2026-04-24
CVE-2026-33076 Roxy-WI vulnerable to path traversal and arbitrary file writing CWE-22 9.8AI Critical AI 2026-04-24
CVE-2026-33432 Roxy-WI has Pre-Authentication LDAP Injection that Leads to Authentication Bypass CWE-287 7.5AI High AI 2026-04-20
CVE-2026-33431 Roxy-WI Vulnerable to Authenticated Arbitrary File Read via Path Traversal in Config Version Viewer CWE-24 8.1AI High AI 2026-04-20
CVE-2026-27811 Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE CWE-77 8.8 High 2026-03-17
CVE-2026-22265 Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE CWE-78 7.5 High 2026-01-15
CVE-2024-13129 Roxy-WI roxy.py action_service os command injection CWE-78 8.8 High 2025-01-03
CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI CWE-78 8.8 High 2024-08-29
CVE-2023-29004 Path Traversal Vulnerability in hap-wi/roxy-wi CWE-22 6.5 Medium 2023-04-17
CVE-2023-25804 Roxy-WI vulnerable to Limited Path Traversal in name parameter CWE-22 7.5 High 2023-03-15
CVE-2023-25802 Roxy-WI has Path Traversal vulnerability CWE-26 7.5 High 2023-03-13
CVE-2023-25803 Roxy-WI 路径遍历漏洞 CWE-22 7.5 High 2023-03-13
CVE-2022-31161 Roxy-WI Vulnerable to Unauthenticated Remote Code Execution via ssl_cert Upload CWE-77 10.0 Critical 2022-07-15
CVE-2022-31137 Unauthenticated Remote Code Execution in Roxy-WI CWE-78 10.0 Critical 2022-07-08

All 32 known CVE vulnerabilities affecting roxy-wi with full Chinese analysis, references, and POCs where available.