CVE-2026-33077

HighPublic PoC

Published: 24 April 2026

Published

24 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0006 18.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33077 is a high-severity Path Traversal (CWE-22) vulnerability in Roxy-Wi Roxy-Wi. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the insufficient input validation of the oldconfig parameter that enables arbitrary file reads via path traversal.

SI-2 Flaw Remediation good match

prevent

Requires timely remediation of the identified flaw by upgrading to the patched version 8.2.6.4, eliminating the vulnerability.

AC-3 Access Enforcement partial match

prevent

Enforces access control policies to restrict unauthorized logical access to files, mitigating the arbitrary file read even if input validation fails.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Unauthenticated arbitrary file read in public-facing web app (Roxy-WI) directly enables T1190 for remote exploitation and T1005 for local file access; also facilitates T1552.001 by exposing credential files.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.

Deeper analysisAI

CVE-2026-33077 is an arbitrary file read vulnerability (CWE-22) in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The issue affects versions prior to 8.2.6.4 and stems from insufficient input validation of the oldconfig parameter in the haproxy_section_save interface, allowing attackers to read arbitrary files on the server.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable over the network with low complexity, no authentication or user interaction required. Unauthenticated remote attackers can leverage this flaw to access sensitive files, potentially exposing configuration data, credentials, or other system information hosted by the Roxy-WI instance.

Mitigation is available in Roxy-WI version 8.2.6.4, which addresses the issue through a targeted fix visible in the project's GitHub commit aecc7971959092fa93e93531f1ffcde33524b031. Additional details are provided in the GitHub Security Advisory GHSA-c799-4ww6-q93w. Security practitioners should upgrade to the patched version and review access controls for Roxy-WI deployments.