Vulnerability Details CVE-2026-27811
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare/<service>/<server_ip>/show` endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in `app/modules/config/config.py` on line 362, where user input is directly formatted in the template string that is eventually executed. Version 8.2.6.3 fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 43.8%
CVSS Severity
CVSS v3 Score 8.8
References
Products affected by CVE-2026-27811
-
cpe:2.3:a:roxy-wi:roxy-wi:-
-
cpe:2.3:a:roxy-wi:roxy-wi:1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:1.1
-
cpe:2.3:a:roxy-wi:roxy-wi:1.10
-
cpe:2.3:a:roxy-wi:roxy-wi:1.10.1
-
cpe:2.3:a:roxy-wi:roxy-wi:1.10.2
-
cpe:2.3:a:roxy-wi:roxy-wi:1.10.2.1
-
cpe:2.3:a:roxy-wi:roxy-wi:1.3
-
cpe:2.3:a:roxy-wi:roxy-wi:1.4
-
cpe:2.3:a:roxy-wi:roxy-wi:1.4.1
-
cpe:2.3:a:roxy-wi:roxy-wi:1.6
-
cpe:2.3:a:roxy-wi:roxy-wi:1.9.1
-
cpe:2.3:a:roxy-wi:roxy-wi:2.0.2
-
cpe:2.3:a:roxy-wi:roxy-wi:3.2.13
-
cpe:2.3:a:roxy-wi:roxy-wi:3.3
-
cpe:2.3:a:roxy-wi:roxy-wi:3.4.4.6
-
cpe:2.3:a:roxy-wi:roxy-wi:3.4.4.7
-
cpe:2.3:a:roxy-wi:roxy-wi:3.4.5
-
cpe:2.3:a:roxy-wi:roxy-wi:3.4.5.1
-
cpe:2.3:a:roxy-wi:roxy-wi:4.4.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.1.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.1.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.1
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.5.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.2.6.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.5.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.3.6.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.4.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.4.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.4.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.4.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.5.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:5.5.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.0.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.0.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.0.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.0.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.1.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.1.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.1.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.1.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.1.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.1.5.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.2.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.2.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.2.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.2.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.10.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.11.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.12.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.13.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.14.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.15.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.16.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.17.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.18.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.19.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.5.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.6.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.7.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.8.0
-
cpe:2.3:a:roxy-wi:roxy-wi:6.3.9.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.0.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.0.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.0.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.0.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.0.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.1.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.1.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.1.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.3.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.4.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.5.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.2.6.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.3.0.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.3.1.0
-
cpe:2.3:a:roxy-wi:roxy-wi:7.3.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:8.0
-
cpe:2.3:a:roxy-wi:roxy-wi:8.0.1
-
cpe:2.3:a:roxy-wi:roxy-wi:8.0.2
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.0.1
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.1
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.2
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.3
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.4
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.5
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.6
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.7
-
cpe:2.3:a:roxy-wi:roxy-wi:8.1.8
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.0
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.1
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.2
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.3
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.4
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.5
-
cpe:2.3:a:roxy-wi:roxy-wi:8.2.6