Arbitrary Command Execution Vulnerability in Termix Server Management Platform
CVE-2026-79766

9.1CRITICAL

Key Information:

Vendor

Termix-ssh

Status
Termix
Vendor
CVE Published:
24 September 2026

What is CVE-2026-79766?

The Termix web-based server management platform is vulnerable to an arbitrary command execution flaw affecting versions 2.4.1 through 2.5.0. An attacker with administrator access can manipulate domain and email settings via the PATCH /users/acme-ssl-settings endpoint. This can lead to the malicious interpolation of those values into a certbot shell command through POST /users/acme-ssl-request. The vulnerable design uses child_process.execSync to execute commands in a shell context, allowing attackers to execute arbitrary operating system commands. The vulnerability affects both HTTP webroot and DNS challenge modes in Termix, potentially compromising sensitive information such as databases, process secrets, stored credentials, and network reachability. The issue has been addressed in the latest release, version 2.5.1.

Affected Version(s)

Termix >= 2.4.1, < 2.5.1

References

https://github.com/Termix-SSH/Termix/security/advisories/...
x_refsource_CONFIRM
https://github.com/Termix-SSH/Termix/pull/1067
x_refsource_MISC
https://github.com/Termix-SSH/Termix/commit/c7a9063a72071...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.