CVE-2022-31126: Roxy-Wi

Critical severity, CVSS 9.8. EPSS: 52.6% chance of exploitation in the next 30 days.

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

• Roxy-Wi Roxy-Wi: before 6.1.1.0 (fixed in 6.1.1.0)

Published 2022-07-06. Last modified 2026-06-17.