CVE-2026-45744

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag	Product Release Notes
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33	Exploit Mitigation Vendor Advisory
https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Termix es una plataforma de gestión de servidores basada en web con terminal SSH, tunelización y capacidades de edición de archivos. Antes de la versión 2.3.2, el endpoint GET /ssh/file_manager/ssh/resolvePath en Termix es vulnerable a la inyección de comandos del sistema operativo. El endpoint utiliza el escape de comillas dobles para la construcción de comandos de shell, lo que no evita la sustitución de comandos $(...) y de comillas invertidas. Cualquier usuario autenticado con una sesión SSH activa del Administrador de Archivos puede ejecutar comandos arbitrarios en el host remoto conectado. La versión 2.3.2 corrige el problema.

Information

Published : 2026-06-05 18:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-45744

Mitre link : CVE-2026-45744

CVE.ORG link : CVE-2026-45744

JSON object : View

Products Affected

termix

termix

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-45744", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45744", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Termix-SSH", "product": "Termix", "versions": [{"status": "affected", "version": "< 2.3.2"}]}]}], "published": "2026-06-05T18:17:29.510", "references": [{"url": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue."}, {"lang": "es", "value": "Termix es una plataforma de gesti\u00f3n de servidores basada en web con terminal SSH, tunelizaci\u00f3n y capacidades de edici\u00f3n de archivos. Antes de la versi\u00f3n 2.3.2, el endpoint GET /ssh/file_manager/ssh/resolvePath en Termix es vulnerable a la inyecci\u00f3n de comandos del sistema operativo. El endpoint utiliza el escape de comillas dobles para la construcci\u00f3n de comandos de shell, lo que no evita la sustituci\u00f3n de comandos $(...) y de comillas invertidas. Cualquier usuario autenticado con una sesi\u00f3n SSH activa del Administrador de Archivos puede ejecutar comandos arbitrarios en el host remoto conectado. La versi\u00f3n 2.3.2 corrige el problema."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "093A7241-2F44-4CF9-A881-7B83370ABB49", "versionEndExcluding": "2.3.2", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}