Skip to content
Heist/ feed
Back to feed
High

Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter

Type: advisorySources: OSV

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-33078
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 19:15 UTC · Revision 1

Source evidence

Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter

core-osv · Original source

Published 24 Apr 2026, 02:05 UTC

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.

osv:CVE-2026-33078
Complete source record
{
  "id": "25a376dea5d49df31a4de6d9fa9c37d7e4b82afc47847c5b1d427dcd8e249225",
  "url": "https://osv.dev/vulnerability/CVE-2026-33078",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Roxy-WI has SQL Injection in haproxy_section_save Endpoint via Unsanitized server_ip Parameter",
    "summary": "Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.",
    "evidence": "osv:CVE-2026-33078",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-33078",
      "aliases": [
        "CVE-2026-33078",
        "GHSA-jmj9-2c4q-849j"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/roxy-wi/roxy-wi",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "d72ea494d0bf1ee220fe141625a4298600f624ad"
                },
                {
                  "fixed": "aecc7971959092fa93e93531f1ffcde33524b031"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "8.2.6.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "aecc7971959092fa93e93531f1ffcde33524b031"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v8.2.6.3",
            "v8.2.8.2",
            "v8.2.8.1",
            "v8.2.6",
            "v8.2.5",
            "v8.2.4",
            "v8.2.3",
            "v8.2.2",
            "v8.2.1",
            "v8.2.0",
            "v8.1.8",
            "v8.1.7",
            "v8.1.6",
            "v8.1.5",
            "v8.1.4",
            "v8.1.3",
            "v8.1.2",
            "v8.1.1",
            "v8.1.0.1",
            "v8.1",
            "v8.0.2",
            "v8.0.1",
            "v8.0",
            "v7.3.2.0",
            "v7.3.1.0",
            "v7.3.0.0",
            "v7.2.6.0",
            "v7.2.5.0",
            "v7.2.4.0",
            "v7.2.3.0",
            "v7.2.2.0",
            "v7.2.1.0",
            "v7.2.0.0",
            "v7.1.2.0",
            "v7.1.1.0",
            "v7.1.0.0",
            "v7.0.4.0",
            "v7.0.3.0",
            "v7.0.2.0",
            "v7.0.1.0",
            "v7.0.0.0",
            "v6.3.19.0",
            "v6.3.18.0",
            "v6.3.17.0",
            "v6.3.16.0",
            "v6.3.15.0",
            "v6.3.14.0",
            "v6.3.13.0",
            "v6.3.12.0",
            "v6.3.11.0",
            "v6.3.10.0",
            "v6.3.9.0",
            "v6.3.8.0",
            "v6.3.7.0",
            "v6.3.6.0",
            "v6.3.5.0",
            "v6.3.4.0",
            "v6.3.3.0",
            "v6.3.2.0",
            "v6.3.1.0",
            "v6.3.0.0",
            "v6.2.3.0",
            "v6.2.2.0",
            "v6.2.1.0",
            "v6.2.0.0",
            "v6.1.5.0",
            "v6.1.4.0",
            "v6.1.3.0",
            "v6.1.2.0",
            "v6.1.1.0",
            "v6.1.0.0",
            "v6.0.3.0",
            "v6.0.2.0",
            "v6.0.1.0",
            "v6.0.0.0",
            "v5.5.1.0",
            "v5.5.0.0",
            "v5.4.3.0",
            "v5.4.2.0",
            "v5.4.1.0",
            "v5.4.0.0",
            "v5.3.6.0",
            "v.5.3.5.0",
            "v5.3.4.0",
            "v5.3.3.0",
            "v5.3.2.0",
            "v5.3.1.0",
            "v5.3.0.0",
            "v5.2.6.0",
            "v5.2.5.0",
            "v5.2.4.0",
            "v5.2.3.0",
            "v5.2.2.0",
            "v5.2.1",
            "v5.2.0",
            "v5.1.4.0",
            "v5.1.1.0",
            "v4.4.1.0",
            "3.4.5.1",
            "3.4.5",
            "3.4.4.7",
            "3.4.4.6",
            "v3.3",
            "v3.2.13",
            "v2.0.2",
            "v1.10.2.1",
            "v1.10.2",
            "v1.10.1",
            "v1.10",
            "v1.9.1",
            "v1.6",
            "v1.4.1",
            "v1.4",
            "v1.3",
            "v1.1",
            "v1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33078.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.782822911Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33078.json",
        "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-jmj9-2c4q-849j",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-33078",
        "https://github.com/roxy-wi/roxy-wi/commit/aecc7971959092fa93e93531f1ffcde33524b031"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-89"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33078.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-33078",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 506062,
  "published_at": "2026-04-24T02:05:02.737+00:00"
}