Vulnerability · Published Jun 10, 2026 · Assigned by GitHub_M

CVE-2026-45559Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)

Medium 4.9

In plain English

A medium-severity security flaw in roxy-wi from roxy-wi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim — no checkAjaxInput, no LDAP escape — and inserted, a username like *)(mail=*)(cn=* injects additional clauses, allowing the admin to enumerate or harvest attributes outside the intended record. At time of publication, there are no publicly available patches.

Affected products (as reported)

Vendor	Product	Versions
roxy-wi	roxy-wi	<= 8.2.6.4

Weakness: CWE-90 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-2257-7mhp-grqp x_refsource_CONFIRM