Roxy‑WI allows an arbitrary file read through the "oldconfig" parameter of the haproxy_section_save endpoint, enabling attackers to read any local file on the host and potentially expose sensitive configuration, credentials, or other privileged data. This remote file disclosure flaw is defined as CWE‑22 and has a CVSS score of 7.7, indicating high severity for data exposure.

The vulnerability affects all Roxy‑WI installations running versions earlier than 8.2.6.4; administrators should verify their current release and upgrade if necessary.

The EPSS score of less than 1% and absence from the CISA KEV catalog indicate a low probability of active exploitation, yet the high CVSS rating means that successful exploitation would give an attacker read access to arbitrary files. The likely attack vector is via the web interface, requiring access to the haproxy_section_save route; compromise of administrative credentials or exposure of the interface would enable exploitation.