CVE-2026-22265
Published: 15 January 2026
Summary
CVE-2026-22265 is a high-severity OS Command Injection (CWE-78) vulnerability in Roxy-Wi Roxy-Wi. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22265 is a command injection vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. Affecting versions prior to 8.2.8.2, the flaw resides in the log viewing functionality at app/modules/roxywi/logs.py line 87, where the grep parameter is processed twice—once in a sanitized manner and once raw—allowing injection of arbitrary system commands. Classified under CWE-78 with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), it was published on January 15, 2026.
Authenticated users with low privileges (PR:L) can exploit this vulnerability remotely over the network without user interaction. By crafting malicious input for the grep parameter during log viewing, attackers gain the ability to execute arbitrary system commands on the underlying host, potentially leading to high-impact confidentiality, integrity, and availability compromises, such as data exfiltration, modification, or denial of service.
The vulnerability is addressed in Roxy-WI version 8.2.8.2, as detailed in the project's GitHub security advisory (GHSA-mmmf-vh7m-rm47), release notes, and the fixing commit (f040d3338c4ba6f66127487361592e32e0188eee). Security practitioners should upgrade to the patched version and review access controls for authenticated users interacting with log viewing features.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2858
Vulnerability details
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to 8.2.8.2, command injection vulnerability exists in the log viewing functionality that allows authenticated users to execute arbitrary system commands. The vulnerability is in app/modules/roxywi/logs.py line…
more
87, where the grep parameter is used twice - once sanitized and once raw. This vulnerability is fixed in 8.2.8.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing web management interface directly enables remote exploitation (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection by requiring validation and sanitization of the user-supplied grep parameter before its raw use in system commands.
Ensures timely installation of the patch in Roxy-WI version 8.2.8.2 that fixes the double-processing flaw in logs.py.
Limits the impact of exploited command injection by enforcing least privilege on the Roxy-WI process, restricting what arbitrary commands can accomplish.