CVE-2026-45750: Termix OS command injection in File Manager resolvePath

CVE-2026-45750 · Severity: critical · CVSS 9 · Published 2026-06-05

Termix, a web-based server management platform, contains a vulnerability in its File Manager component that allows users to execute unauthorized commands on connected servers. By manipulating file path requests, an attacker can run arbitrary code on their own connected systems or, due to a session management flaw, on servers belonging to other users. This could lead to full system compromise, unauthorized data access, and complete loss of control over the managed infrastructure.

Technologies: Termix-SSH Termix. Vendors: Termix-SSH.

Quick answers

Is CVE-2026-45750 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45750 being exploited in the wild.
How severe is CVE-2026-45750?
Critical severity, with a CVSS score of 9, published 5 June 2026.
Which products and versions are affected?
Termix-SSH Termix < 2.3.2.
Is there a fix for CVE-2026-45750?
A patch was published on 2026-06-04: Version 2.3.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45750 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45750?
Check whether you run Termix-SSH Termix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the Termix File Manager component due to improper neutralization of shell special characters. The 'resolvePath' endpoint takes a user-provided 'path' parameter and embeds it into an 'echo' command executed over an active SSH session. While the application attempts to escape double quotes, it fails to neutralize shell command substitution syntax like '$(...)'. An authenticated attacker can use this to execute arbitrary commands on the remote host. Furthermore, because the application does not properly validate 'sessionId' ownership, an attacker can target the SSH sessions of other active users on the same Termix instance. This issue is resolved in version 2.3.2.

Affected products

  • Termix-SSH Termix < 2.3.2

Timeline

  • 2026-05-31: advisory: GitHub Security Advisory GHSA-v26q-rpv5-9m72 published
  • 2026-06-04: patched: Version 2.3.2 released
  • 2026-06-05: disclosed: CVE-2026-45750 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.