Termix Vulnerable to Arbitrary Command Execution in File Manager
CVE-2026-45750

9CRITICAL

Key Information:

Vendor

Termix-ssh

Status
Termix
Vendor
CVE Published:
5 June 2026

What is CVE-2026-45750?

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.

Affected Version(s)

Termix < 2.3.2

References

https://github.com/Termix-SSH/Termix/security/advisories/...
x_refsource_CONFIRM
https://github.com/Termix-SSH/Termix/releases/tag/release...
x_refsource_MISC

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.