CVE-2026-33078: Roxy-Wi

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.

Affected products

• Roxy-Wi Roxy-Wi: before 8.2.6.4 (fixed in 8.2.6.4)

Published 2026-04-24. Last modified 2026-06-17.