CVE-2023-25804

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. Versions prior to 6.3.5.0 have a limited path traversal vulnerability. An SSH key can be saved into an unintended location, for example the `/tmp` folder using a payload `../../../../../tmp/test111_dev`. This issue has been fixed in version 6.3.5.0.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
hap-wi	roxy-wi	< 6.3.5.0

References

https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-69j6-crq8-rrhvExploit, Third Party Advisory
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-69j6-crq8-rrhvExploit, Third Party Advisory

Timeline

Published: Mar 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-258059.8versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to ve CVE-2023-258065.3OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy CVE-2023-258075.4DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified CVE-2023-258096.3runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless r CVE-2023-258105.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma status page allows a persistent XSS attack. Users CVE-2023-258115.4Uptime Kuma is a self-hosted monitoring tool. In versions prior to 1.20.0 the Uptime Kuma `name` parameter allows a persistent XSS attack. U CVE-2023-258128.8Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio CVE-2023-258139.8Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are pa CVE-2023-258146.5metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file th CVE-2023-258152.2In Git for Windows, the Windows port of Git, no localized messages are shipped with the installer. As a consequence, Git is expected not to CVE-2023-258166.5Nextcloud is an Open Source private cloud software. Versions 25.0.0 and above, prior to 25.0.3, are subject to Uncontrolled Resource Consump CVE-2023-258178.1Nextcloud server is an open source, personal cloud implementation. In versions from 24.0.0 and before 24.0.9 a user could escalate their per