The vulnerability lies in the POST /config/<service>/show endpoint of Roxy‑WI prior to version 8.2.6.4. The endpoint accepts a configver parameter that is concatenated with a fixed base directory path to build a local file path. The code does not validate the configver value, allowing an authenticated user to supply paths containing '..' sequences. This permits the attacker to traverse directories and read arbitrary files accessible to the web application process. The primary impact is confidential data disclosure as the attacker can read arbitrary files on the server. This weakness corresponds to CWE-24 Path Traversal.

Roxy‑WI, a web management interface for Haproxy, Nginx, Apache and Keepalived. The affected product is roxy-wi:roxy-wi. Versions prior to 8.2.6.4 are vulnerable. Users running any earlier release of Roxy‑WI that provides the /config/<service>/show API endpoint should validate that the configver parameter is sanitized.

The CVSS score of 5.7 indicates a moderate severity. Exploitation requires authenticated access to the web interface, but the control plane is typically reserved for administrators, increasing the potential value of disclosed data. No EPSS score is available; the vulnerability is not listed in CISA KEV, suggesting no public exploits yet. The attack propagates through the web application layer, potentially exposing configuration files, logs or other sensitive content that the web process can read. The attacker must be able to authenticate and then submit a crafted configver value to the API. Due to the lack of remote code execution, the exploitation risk is confined to data disclosure rather than full system compromise.