CVE-2026-27811

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-27811

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27811.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-27811

Aliases

GHSA-jvmv-cw47-jh77

Published

2026-03-17T23:43:05.871Z

Modified

2026-04-02T13:26:32.671842Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Roxy-WI has a Command Injection via diff parameter in config comparison allows authenticated RCE

Details

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the /config/compare/<service>/<server_ip>/show endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in app/modules/config/config.py on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27811.json"
}

References

Affected packages

Git / github.com/hap-wi/roxy-wi

Affected ranges

Type

GIT

Repo

https://github.com/hap-wi/roxy-wi

Events

Introduced

Fixed

a10ac7306c252014f97a7213db4a9470300fa064

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.2.6.3"
        }
    ]
}

Affected versions

3.*

3.4.4.6

3.4.4.7

3.4.5

3.4.5.1

v.*

v.5.3.5.0

v1.*

v1.0

v1.1

v1.10

v1.10.1

v1.10.2

v1.10.2.1

v1.3

v1.4

v1.4.1

v1.6

v1.9.1

v2.*

v2.0.2

v3.*

v3.2.13

v3.3

v4.*

v4.4.1.0

v5.*

v5.1.1.0

v5.1.4.0

v5.2.0

v5.2.1

v5.2.2.0

v5.2.3.0

v5.2.4.0

v5.2.5.0

v5.2.6.0

v5.3.0.0

v5.3.1.0

v5.3.2.0

v5.3.3.0

v5.3.4.0

v5.3.6.0

v5.4.0.0

v5.4.1.0

v5.4.2.0

v5.4.3.0

v5.5.0.0

v5.5.1.0

v6.*

v6.0.0.0

v6.0.1.0

v6.0.2.0

v6.0.3.0

v6.1.0.0

v6.1.1.0

v6.1.2.0

v6.1.3.0

v6.1.4.0

v6.1.5.0

v6.2.0.0

v6.2.1.0

v6.2.2.0

v6.2.3.0

v6.3.0.0

v6.3.1.0

v6.3.10.0

v6.3.11.0

v6.3.12.0

v6.3.13.0

v6.3.14.0

v6.3.15.0

v6.3.16.0

v6.3.17.0

v6.3.18.0

v6.3.19.0

v6.3.2.0

v6.3.3.0

v6.3.4.0

v6.3.5.0

v6.3.6.0

v6.3.7.0

v6.3.8.0

v6.3.9.0

v7.*

v7.0.0.0

v7.0.1.0

v7.0.2.0

v7.0.3.0

v7.0.4.0

v7.1.0.0

v7.1.1.0

v7.1.2.0

v7.2.0.0

v7.2.1.0

v7.2.2.0

v7.2.3.0

v7.2.4.0

v7.2.5.0

v7.2.6.0

v7.3.0.0

v7.3.1.0

v7.3.2.0

v8.*

v8.0

v8.0.1

v8.0.2

v8.1

v8.1.0.1

v8.1.1

v8.1.2

v8.1.3

v8.1.4

v8.1.5

v8.1.6

v8.1.7

v8.1.8

v8.2.0

v8.2.1

v8.2.2

v8.2.3

v8.2.4

v8.2.5

v8.2.6

v8.2.8.1

v8.2.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27811.json"

Git / github.com/roxy-wi/roxy-wi