CVE-2026-33076 is a critical (CVSS 9.8) path traversal in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache and Keepalived. Before 8.2.6.4, a file write flaw in the HAProxy section save endpoint can lead to remote code execution. Upgrade to 8.2.6.4.
What's affected
The NVD record says Roxy-WI versions before 8.2.6.4, and that 8.2.6.4 fixes the issue. The GitHub advisory lists the pip package roxy-wi at 8.2.6.3 and earlier, but shows no patched version in its summary. Check the project's releases to confirm what you can install.
How to check if you're exposed
If you installed from pip, check the version:
pip show roxy-wi
For other installs, the version is shown in the Roxy-WI interface or in your deployment configuration. Also check whether the web interface is reachable from untrusted networks, because the CVSS vector indicates no authentication or user interaction.
What to do now
- Upgrade Roxy-WI to 8.2.6.4 or later.
- Restrict the web interface to trusted networks or a VPN until you have upgraded.
- Review scheduled task locations on the host for entries you did not create, since the advisory describes writing into scheduled tasks.
- Review the files Roxy-WI manages for unexpected changes.
Why it matters
The weakness class is CWE-22. According to the advisory, a value taken from the URL path is used to build a file name without validation. That lets the request steer where the application writes, including outside the folder meant for configuration files.
Writing attacker influenced content to a system scheduled task location is a well known route to code execution. Roxy-WI sits in front of load balancers and web servers, so the host often has broad reach into other systems. The same release also fixes a SQL injection in the same endpoint, CVE-2026-33078. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Which version fixes it?
The NVD record says 8.2.6.4. The advisory page did not list a patched version, so confirm against the project's release notes.
Sources
Last reviewed: 19 October 2026.
