# CVE-2026-42453: Termix-SSH Termix command injection in file-manager.ts

Source: https://junglewise.ai/threats/cve-2026-42453-termix-ssh-termix-command-injection-in-file-manager-ts  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-42453 · Severity: info · CVSS 8.7 · Published 2026-05-08

Termix is a web-based platform used for managing servers via SSH, including file editing and terminal access. A security flaw in the file management component allows an attacker to execute unauthorized commands on the remote server being managed. This could lead to a full system compromise of the managed server, even if the user's access was supposed to be restricted to file operations only.

Technologies: [Termix-SSH Termix](https://junglewise.ai/threats/technologies/termix). Vendors: [Termix-SSH](https://junglewise.ai/threats/vendors/termix-ssh).

## Quick answers

**Is CVE-2026-42453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42453 being exploited in the wild.

**How severe is CVE-2026-42453?** Informational severity, with a CVSS score of 8.7, published 8 May 2026.

**Which products and versions are affected?** Termix-SSH Termix < 2.1.0; Termix-SSH <= 1.10.2.

**Is there a fix for CVE-2026-42453?** A patch was published on 2026-04-22: Version 2.1.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42453 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42453?** Check whether you run Termix-SSH Termix or Termix-SSH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in Termix prior to version 2.1.0 within the `extractArchive` and `compressFiles` endpoints of `file-manager.ts`. The root cause is the use of double-quoted strings for shell command construction (e.g., `tar` and `zip` commands), which permits shell expansion and `$(command)` substitution. This differs from other components in the application that correctly use single-quote escaping. An attacker with file manager access can provide malicious file paths containing shell subcommands to achieve arbitrary command execution on the remote SSH host. This effectively bypasses security configurations where a user is granted file manager permissions but denied terminal access. The issue is resolved in version 2.1.0.

## Affected products

- Termix-SSH Termix < 2.1.0

## Timeline

- 2026-04-22: patched: Version 2.1.0 released
- 2026-04-22: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD

## References

- [https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag](https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag)
- [https://github.com/Termix-SSH/Termix/security/advisories/GHSA-rvg4-7vvq-9c2w](https://github.com/Termix-SSH/Termix/security/advisories/GHSA-rvg4-7vvq-9c2w)

## Related threats

- [Termix file-manager path traversal in transferToHost](https://junglewise.ai/threats/cve-2026-120322-a-vulnerability-was-identified-in-termix-ssh-termix-up-to-2-9-2)
- [Termix command injection in ACME SSL settings](https://junglewise.ai/threats/cve-2026-79766-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix server management platform SSRF via proxy endpoint](https://junglewise.ai/threats/cve-2026-79764-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix two-factor authentication bypass in TOTP disable endpoints](https://junglewise.ai/threats/cve-2026-79763-termix-is-a-web-based-server-management-platform-with-ssh)
- [Termix weak key derivation in OIDC and WebAuthn user encryption](https://junglewise.ai/threats/cve-2026-79762-termix-is-a-web-based-server-management-platform-with-ssh)