A bug in the path‑validation routine of Roxy‑WI allows an attacker to supply a configuration file name that contains relative path components such as '..'. The check uses tuple membership instead of substring containment, which means that realistic traversal payloads like '../../etc/passwd' are accepted. This flaw is described by CWE‑22 and CWE‑697 and would enable the attacker to read arbitrary files on the host, potentially exposing sensitive configuration data or credentials.

The affected product is Roxy‑WI, version 8.2.6.4 and earlier. These releases contain the buggy validation logic in the config module.

The vulnerability has a CVSS score of 8.1, indicating high severity. No EPSS score is available and it is not listed in the CISA KEV catalog. The likely attack vector is the web interface; based on the description it is inferred that an attacker with authenticated access that can submit configuration updates could exploit the flaw to read any file accessible by the service process, especially if it runs with elevated privileges.