Vulnerability · Published Jan 15, 2026 · Assigned by GitHub_M

CVE-2026-22265Roxy-WI has a Command Injection via grep parameter in logs.py allows authenticated RCE

High 7.5

In plain English

A high-severity OS command injection in roxy-wi from roxy-wi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.3%top 16.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line 87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.

Affected products (as reported)

Vendor	Product	Versions
roxy-wi	roxy-wi	< 8.2.8.2

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-mmmf-vh7m-rm47 x_refsource_CONFIRM
https://github.com/roxy-wi/roxy-wi/commit/f040d3338c4ba6f66127487361592e32e0188eee x_refsource_MISC
https://github.com/roxy-wi/roxy-wi/releases/tag/v8.2.8.2 x_refsource_MISC