The haproxy_section_save interface in Roxy-WI allows an authenticated user to craft a request that performs a path traversal and writes an arbitrary file into the scheduled tasks directory. This flaw can be used to drop a web shell or modify system startup scripts, leading to remote code execution on the host. The weakness is a classic path traversal (CWE-22).

Vendor roxy-wi, product roxy-wi. Versions prior to 8.2.6.4, specifically any instance of Roxy‑WI 8.2.6.3 or earlier, are vulnerable. No older versions were explicitly identified as unaffected.

The CVSS score of 8.9 indicates high severity. The EPSS score is below 1 %, suggesting that exploitation is currently unlikely to be widespread, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be executed remotely by sending a specially crafted HTTP request to the haproxy_section_save endpoint, assuming the attacker has valid authentication credentials or can otherwise obtain them. Successful exploitation allows the attacker to write files to arbitrary locations within the application’s filesystem, which can be leveraged for remote code execution.