CVE-2026-33078

Katalog CVE

CVSS 9.8 · Critical EPSS 0,52%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada roxy-wi. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jmj9-2c4q-849j exploit · mitigasi · advisory vendor
• https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031 patch