# CVE-2026-120322: Termix file-manager path traversal in transferToHost

Source: https://junglewise.ai/threats/cve-2026-120322-a-vulnerability-was-identified-in-termix-ssh-termix-up-to-2-9-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120322 · Severity: critical · CVSS 9.9 · Published 2026-11-02

Termix is a web-based SSH client that allows authenticated users to manage files on remote servers. An authenticated attacker can exploit a path traversal flaw in the file transfer feature to write arbitrary files to the Termix server itself, potentially allowing them to execute malicious code, steal credentials, or completely take over the Termix instance.

Technologies: [Termix-SSH Termix](https://junglewise.ai/threats/technologies/termix). Vendors: [Termix-SSH](https://junglewise.ai/threats/vendors/termix-ssh).

## Quick answers

**Is CVE-2026-120322 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120322 being exploited in the wild.

**How severe is CVE-2026-120322?** Critical severity, with a CVSS score of 9.9, published 2 November 2026.

**Which products and versions are affected?** Termix-SSH Termix up to 2.9.2.

**Is there a fix for CVE-2026-120322?** Yes: fixed in Termix core v26.10.0; standalone File Manager plugin v1.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120322 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120322?** Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Termix core v26.10.0; standalone File Manager plugin v1.0.0

## Technical details

The vulnerability is a path traversal (CWE-22) combined with trust-boundary confusion (CWE-290) in the file-manager plugin's transferToHost endpoint. An attacker creates a session with a recorded IP of 127.0.0.1 by spoofing loopback in the /connect request while routing the actual SSH connection through an attacker-controlled SOCKS5 proxy. The backend then treats the session as local, bypassing validation and allowing an unvalidated destPath parameter to write files anywhere on the Termix filesystem with backend process privileges.

## Affected products

- Termix-SSH Termix up to 2.9.2

## Timeline

- 2026-11-02: disclosed

## References

- [https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md](https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md)
- [https://vuldb.com/cve/CVE-2026-120322](https://vuldb.com/cve/CVE-2026-120322)

## Related threats

- [Termix command injection in ACME SSL settings](https://junglewise.ai/threats/cve-2026-79766-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix server management platform SSRF via proxy endpoint](https://junglewise.ai/threats/cve-2026-79764-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix two-factor authentication bypass in TOTP disable endpoints](https://junglewise.ai/threats/cve-2026-79763-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix weak key derivation in OIDC and WebAuthn user encryption](https://junglewise.ai/threats/cve-2026-79762-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix SSH key deployment command injection](https://junglewise.ai/threats/cve-2026-79761-termix-is-a-web-based-server-management-platform-with-ssh)