{"id":"CVE-2026-45569","summary":"Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)","details":"Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 (\"Expand validation to block .. in config_file_name and configver for improved security\") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to the literal string '..'. For any realistic path-traversal payload (../../etc/passwd, ..\\\\..\\\\etc\\\\passwd, etc.) the check returns False and the patch silently lets the payload through. At time of publication, there are no publicly available patches.","aliases":["GHSA-j6p4-8532-h9hv"],"modified":"2026-07-15T01:49:10.166112460Z","published":"2026-06-10T15:38:17.385Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-697"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45569.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45569.json"},{"type":"ADVISORY","url":"https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-j6p4-8532-h9hv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45569"},{"type":"FIX","url":"https://github.com/roxy-wi/roxy-wi/commit/d4d10006"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/roxy-wi/roxy-wi","events":[{"introduced":"0"},{"fixed":"d4d10006"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"8.2.6.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45569.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}