Executive brief
Termix, a web-based server management platform, contains a vulnerability in its File Manager component that allows users to execute unauthorized commands on connected servers. By manipulating file path requests, an attacker can run arbitrary code on their own connected systems or, due to a session management flaw, on servers belonging to other users. This could lead to full system compromise, unauthorized data access, and complete loss of control over the managed infrastructure.
Technical details
An OS command injection vulnerability exists in the Termix File Manager component due to improper neutralization of shell special characters. The 'resolvePath' endpoint takes a user-provided 'path' parameter and embeds it into an 'echo' command executed over an active SSH session. While the application attempts to escape double quotes, it fails to neutralize shell command substitution syntax like '$(...)'. An authenticated attacker can use this to execute arbitrary commands on the remote host. Furthermore, because the application does not properly validate 'sessionId' ownership, an attacker can target the SSH sessions of other active users on the same Termix instance. This issue is resolved in version 2.3.2.
Affected products
- Termix-SSH Termix < 2.3.2
Timeline
- 2026-05-31: advisory: GitHub Security Advisory GHSA-v26q-rpv5-9m72 published
- 2026-06-04: patched: Version 2.3.2 released
- 2026-06-05: disclosed: CVE-2026-45750 published to NVD