Executive Summary

The CVE-2026-45565 vulnerability is a flaw in the EscapedString validator within the Roxy-WI application. This validator is supposed to strip dangerous metacharacters like ;, &, |, $, and backticks from input strings to prevent malicious input. However, it fails to properly handle the '..' sequence when these metacharacters are present.

Because of the validator's logic, if an input contains a metacharacter, it triggers a branch that strips those metacharacters but skips the check that blocks '..'. This allows attackers to bypass security checks and use path traversal sequences like '../../etc/passwd;' without being blocked or properly quoted.

This flaw affects about 52 fields in the application and can lead to serious issues such as path traversal and remote code execution (RCE). For example, an attacker could manipulate SSH credential names to write files to unintended locations by appending a metacharacter to a '..' payload.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have a high impact on your system's confidentiality and integrity. An attacker with low privileges and no user interaction can exploit it remotely over the network.

Potential impacts include arbitrary file writes, such as writing decrypted SSH private keys to unintended locations, path traversal attacks that allow access to sensitive files, and remote code execution through vulnerable functions.

Because the attack complexity is low and no user interaction is required, it is relatively easy for attackers to exploit this vulnerability if the system is running a vulnerable version of Roxy-WI.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the Roxy-WI application is using the vulnerable EscapedString validator in versions 8.2.6.4 and prior. Since the flaw allows path traversal and remote code execution via specially crafted inputs containing '..' combined with metacharacters like ;, &, |, $, or backticks, monitoring for such suspicious input patterns in logs or network traffic can help detect exploitation attempts.

Specifically, you can search application logs or network traffic for inputs or requests containing sequences like '../../etc/passwd;' or '../../etc/passwd&' targeting fields such as SSH credential names or usernames.

Example commands to detect potential exploitation attempts include:

• Using grep to search application logs for suspicious payloads: grep -E "\.\./\.\./etc/passwd[;&|$`]" /path/to/roxy-wi/logs/*
• Using network monitoring tools like tcpdump or Wireshark to filter HTTP requests containing '..' and metacharacters: tcpdump -A -s 0 'tcp port 80 and (((tcp[((tcp[12:1] & 0xf0) >> 2):4]) contains "..") and (tcp[((tcp[12:1] & 0xf0) >> 2):1] contains ";" or contains "&" or contains "|" or contains "$" or contains "`"))'

Note that these commands are examples based on the vulnerability description and should be adapted to your environment and log locations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Roxy-WI application to trusted users and networks to reduce the attack surface.

Since no public patches are available at the time of publication, you should implement input validation controls externally if possible, such as web application firewalls (WAFs) to block requests containing suspicious patterns like '..' combined with metacharacters (;, &, |, $, backticks).

Additionally, monitor logs and network traffic for exploitation attempts and consider disabling or limiting features that accept user input for SSH credential names, usernames, or descriptions until a fix is available.

The recommended fix involves modifying the EscapedString validator to check for the '..' sequence before stripping metacharacters and rejecting forward slashes, backslashes, and NUL bytes in filename components.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Roxy-WI allows attackers to perform path traversal and remote code execution, leading to unauthorized access and modification of sensitive data such as SSH private keys. This results in a high impact on confidentiality and integrity of data.

Such unauthorized access and potential data breaches can negatively affect compliance with common standards and regulations like GDPR and HIPAA, which require strict protection of sensitive information and maintaining data confidentiality and integrity.

Useful 0 Not Useful 0