CVE-2026-33077

HighPublic PoC

Published: 24 April 2026

Published

24 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v4 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0009 25.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33077 is a high-severity Path Traversal (CWE-22) vulnerability in Roxy-Wi Roxy-Wi. Its CVSS base score is 7.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-33077 is an arbitrary file read vulnerability (CWE-22) in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The issue affects versions prior to 8.2.6.4 and stems from insufficient input validation of the oldconfig parameter in the haproxy_section_save interface, allowing attackers to read arbitrary files on the server.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable over the network with low complexity, no authentication or user interaction required. Unauthenticated remote attackers can leverage this flaw to access sensitive files, potentially exposing configuration data, credentials, or other system information hosted by the Roxy-WI instance.

Mitigation is available in Roxy-WI version 8.2.6.4, which addresses the issue through a targeted fix visible in the project's GitHub commit aecc7971959092fa93e93531f1ffcde33524b031. Additional details are provided in the GitHub Security Advisory GHSA-c799-4ww6-q93w. Security practitioners should upgrade to the patched version and review access controls for Roxy-WI deployments.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-25376

Vulnerability details

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the oldconfig parameter in the haproxy_section_save interface has an arbitrary file read vulnerability. Version 8.2.6.4 fixes the issue.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Unauthenticated arbitrary file read in public-facing web app (Roxy-WI) directly enables T1190 for remote exploitation and T1005 for local file access; also facilitates T1552.001 by exposing credential files.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1