CVE CVE-2026-22265

CVE-2026-22265

nginx

Severity: HIGH
CVSS: 7.5CVSS
Published: 2026-01-15
Last modified: 2026-02-18
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-78

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line 87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.

References

https://github.com/roxy-wi/roxy-wi/commit/f040d3338c4ba6f66127487361592e32e0188eee
https://github.com/roxy-wi/roxy-wi/releases/tag/v8.2.8.2
https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmmf-vh7m-rm47

Summary

Description

References