Executive brief
Termix is a web-based platform used for managing servers via SSH, including file editing and terminal access. A security flaw in the file management component allows an attacker to execute unauthorized commands on the remote server being managed. This could lead to a full system compromise of the managed server, even if the user's access was supposed to be restricted to file operations only.
Technical details
A command injection vulnerability exists in Termix prior to version 2.1.0 within the `extractArchive` and `compressFiles` endpoints of `file-manager.ts`. The root cause is the use of double-quoted strings for shell command construction (e.g., `tar` and `zip` commands), which permits shell expansion and `$(command)` substitution. This differs from other components in the application that correctly use single-quote escaping. An attacker with file manager access can provide malicious file paths containing shell subcommands to achieve arbitrary command execution on the remote SSH host. This effectively bypasses security configurations where a user is granted file manager permissions but denied terminal access. The issue is resolved in version 2.1.0.
Affected products
- Termix-SSH Termix < 2.1.0
Timeline
- 2026-04-22: patched: Version 2.1.0 released
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD