Executive brief
Termix is a web-based platform used by administrators to manage servers through SSH terminals and file editing tools. A security flaw allows an authorized user to bypass security restrictions and run unauthorized commands on any remote server they are connected to. This could lead to full system takeover, data theft, or the deletion of critical files on the managed infrastructure.
Technical details
An OS command injection vulnerability exists in the `resolvePath` endpoint of Termix's File Manager component. The root cause is improper neutralization of shell metacharacters; specifically, the application uses double-quote escaping (`replace(/"/g, '\\"')`) when constructing a shell `echo` command. This fails to prevent command substitution via `$(...)` or backticks, which are still interpreted by POSIX-compliant shells within double quotes. An authenticated attacker with an active File Manager session can provide a malicious `path` parameter to execute arbitrary code on the remote target host with the privileges of the SSH user. The issue is fixed in version 2.3.2 by implementing single-quote escaping consistent with other endpoints in the application.
Affected products
- Termix-SSH Termix < 2.3.2
Timeline
- 2026-05-31: advisory: GitHub Security Advisory GHSA-37f4-wq95-pg33 published
- 2026-06-04: patched: Version 2.3.2 released
- 2026-06-05: disclosed: CVE-2026-45744 published to NVD