Stored Cross-Site Scripting in Termix Web Management Platform
CVE-2026-22804

8HIGH

Key Information:

Vendor

Termix-ssh

Status
Termix
Vendor
CVE Published:
12 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-22804?

The Termix web-based server management platform has a critical vulnerability within its File Manager component, affecting versions 1.7.0 to 1.9.0. This vulnerability arises from the application's failure to sanitize SVG file content before display. An attacker with access to a compromised SSH server can upload a malicious SVG file, which, when viewed by an unsuspecting Termix user, executes arbitrary JavaScript. This poses a significant risk to the security of the application and its users. The issue has been resolved in version 1.10.0.

Affected Version(s)

Termix >= 1.7.0, < 1.10.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-22804
Created by ThemeHackers

References

https://github.com/Termix-SSH/Termix/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.