Roxy‑WI, a web interface for managing load balancer services such as HAProxy, Nginx, Apache, and Keepalived, contains a flaw in the WAF rule save endpoint that allows an authenticated user to supply a config_file_name field. The value is written verbatim to the server’s filesystem, bypassing adequate path checks because the encoded slash translation is performed before the substring validation. An attacker can therefore construct absolute paths that satisfy the limited service substring rules, drop arbitrary files such as cron jobs, and execute code as root on the load balancer. This leads to full remote code execution on any load balancer that the attacker’s account is authorized to manage.

The vulnerability affects Roxy‑WI versions 8.2.6.4 and earlier. Systems running these versions control HAProxy, Nginx, Apache, or Keepalived services through the Roxy‑WI interface, providing the applicable attack surface.

The CVSS score of 9.9 indicates a critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the Roxy‑WI instance and the ability to POST to the WAF rule save route. Once an attacker gains these credentials, file writes can occur anywhere that matches the service and configuration substrings, allowing them to install cron jobs or other privileged files and achieve root-level code execution.