Is CVE-2026-120322 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120322 being exploited in the wild.

How severe is CVE-2026-120322?

Critical severity, with a CVSS score of 9.9, published 2 November 2026.

Is there a fix for CVE-2026-120322?

Yes: fixed in Termix core v26.10.0; standalone File Manager plugin v1.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120322 attacked?

It is attacked over the network.

Am I affected by CVE-2026-120322?

Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120322: Termix file-manager path traversal in transferToHost

CVE-2026-120322 · Severity: critical · CVSS 9.9 · Published 2026-11-02

Termix is a web-based SSH client that allows authenticated users to manage files on remote servers. An authenticated attacker can exploit a path traversal flaw in the file transfer feature to write arbitrary files to the Termix server itself, potentially allowing them to execute malicious code, steal credentials, or completely take over the Termix instance.

Technologies: Termix-SSH Termix. Vendors: Termix-SSH.

Quick answers

Is CVE-2026-120322 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120322 being exploited in the wild.
How severe is CVE-2026-120322?: Critical severity, with a CVSS score of 9.9, published 2 November 2026.
Which products and versions are affected?: Termix-SSH Termix up to 2.9.2.
Is there a fix for CVE-2026-120322?: Yes: fixed in Termix core v26.10.0; standalone File Manager plugin v1.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120322 attacked?: It is attacked over the network.
Am I affected by CVE-2026-120322?: Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Termix core v26.10.0; standalone File Manager plugin v1.0.0

Technical details

The vulnerability is a path traversal (CWE-22) combined with trust-boundary confusion (CWE-290) in the file-manager plugin's transferToHost endpoint. An attacker creates a session with a recorded IP of 127.0.0.1 by spoofing loopback in the /connect request while routing the actual SSH connection through an attacker-controlled SOCKS5 proxy. The backend then treats the session as local, bypassing validation and allowing an unvalidated destPath parameter to write files anywhere on the Termix filesystem with backend process privileges.

Affected products

Termix-SSH Termix up to 2.9.2

Timeline

2026-11-02: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.