CVE-2026-45744

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag	Product Release Notes
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33	Exploit Mitigation Vendor Advisory
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-05 18:17

Updated : 2026-06-17 10:52

NVD link : CVE-2026-45744

Mitre link : CVE-2026-45744

CVE.ORG link : CVE-2026-45744

JSON object : View

Products Affected

termix

termix

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-45744", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45744", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Termix-SSH", "product": "Termix", "versions": [{"status": "affected", "version": "< 2.3.2"}]}]}], "published": "2026-06-05T18:17:29.510", "references": [{"url": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue."}], "lastModified": "2026-06-17T10:52:31.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "093A7241-2F44-4CF9-A881-7B83370ABB49", "versionEndExcluding": "2.3.2", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}