CVE-2026-45744
9.9 CRITICALTermix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities
Published: 2026-06-05 · Last updated: 2026-06-08
Severity and scoring
- CVSS
- 9.9 CRITICAL
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CWE
- CWE-78
Affected products
| Vendor | Product |
|---|---|
| termix | termix |
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45744
- [Other]https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag
- [Vendor advisory]https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33
- [Vendor advisory]https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33
Related CVEs
Same vendor
- CVE-2026-45750 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (9.0 CRITICAL)
- CVE-2026-45749 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (8.1 HIGH)
- CVE-2026-45748 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (9.8 CRITICAL)
- CVE-2026-45746 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (9.0 CRITICAL)
- CVE-2026-45745 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (8.0 HIGH)
Same CWE
- CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
- CVE-2026-42563 — Dulwich is a pure-Python implementation of the Git file formats and protocols
- CVE-2026-0273 — A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrict...
- CVE-2026-6893 — A flaw was found in dracut (8.8 HIGH)
- CVE-2026-46643 — Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page