Executive Summary

CVE-2026-45560 is a stored cross-site scripting (XSS) vulnerability in the Roxy-WI log viewer affecting versions 8.2.6.4 and earlier.

The vulnerability arises because the functions wrap_line and highlight_word generate raw HTML by string concatenation without proper escaping.

An attacker who can write a line into a managed HAProxy or Nginx access log (for example, by sending an HTTP request to the public load balancer) can inject a malicious payload such as <svg/onload=...>.

This payload executes when a Roxy-WI administrator opens the log viewer, due to the frontend using .html(data) to render the log content, which allows stored XSS.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute malicious scripts in the context of the Roxy-WI admin's browser when they view the logs.

Potential impacts include stealing session cookies, which can lead to session hijacking, and privilege escalation.

The attack requires no privileges and minimal user interaction, making it easier for attackers to exploit.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if malicious HTML or JavaScript payloads, such as <svg/onload=...>, have been injected into the HAProxy or Nginx access logs managed by Roxy-WI.

Since the vulnerability arises from unescaped HTML in log entries, you can inspect the access logs for suspicious entries containing script or SVG tags.

Suggested commands to detect potential exploitation attempts include searching the access logs for suspicious payloads. For example:

• grep -iE '<svg|<script|onload=' /path/to/haproxy/access.log
• grep -iE '<svg|<script|onload=' /path/to/nginx/access.log

Additionally, monitoring HTTP requests to the load balancer for unusual User-Agent headers or other fields containing HTML tags can help detect attempts to inject malicious payloads.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include preventing the execution of injected HTML/JavaScript in the Roxy-WI log viewer by avoiding rendering raw HTML from log entries.

Specifically, the recommended fix is to escape HTML content properly using Jinja's auto-escape features and to replace the frontend usage of .html(data) with .text(data) or equivalent methods that do not interpret HTML.

Since no public patches are available at the time of publication, you should restrict access to the Roxy-WI log viewer to trusted administrators only and monitor logs for suspicious entries.

Additionally, consider filtering or sanitizing HTTP request fields (like User-Agent) at the load balancer or web server level to block payloads containing HTML or script tags.

Useful 0 Not Useful 0