The EscapedString validator in Roxy‑WI versions 8.2.6.4 and earlier allows attackers to bypass the '..' sanitization block when they append characters such as ';', '&', '|', '$', or backtick to a path traversal string. Because the validator does not shlex‑quote the value, injected command components can be executed, giving the attacker remote code execution through the web interface.

The vulnerability affects Roxy‑WI by roxy‑wi. All deployments running version 8.2.6.4 or any earlier release are impacted. No later versions are listed as affected.

The CVSS score of 8.1 indicates high severity, and while the EPSS score is unavailable, the absence of a KEV listing does not diminish the potential impact. An attacker who can reach the Roxy‑WI web console can craft a malicious field containing a '..' traversal followed by a command separator, causing the system to execute arbitrary commands. The vulnerability is exploitable in a remote context without authentication beyond the web interface access required for the affected fields.