CVE-2026-45750

9.0 CRITICAL

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities

Published: 2026-06-05 · Last updated: 2026-06-08

Severity and scoring

CVSS: 9.0 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CWE: CWE-639, CWE-78

Affected products

Vendor	Product
termix	termix

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-45750
[Other]https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag
[Vendor advisory]https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72
[Vendor advisory]https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72

Related CVEs

Same vendor

CVE-2026-45749 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (8.1 HIGH)
CVE-2026-45748 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (9.8 CRITICAL)
CVE-2026-45746 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (9.0 CRITICAL)
CVE-2026-45745 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (8.0 HIGH)
CVE-2026-45744 — Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities (9.9 CRITICAL)

Same CWE

CVE-2026-49219 — ImageMagick is free and open-source software used for editing and manipulating digital images (5.5 MEDIUM)
CVE-2026-42563 — Dulwich is a pure-Python implementation of the Git file formats and protocols
CVE-2026-44692 — Sharp is a content management framework built for Laravel as a package (7.7 HIGH)
CVE-2026-0273 — A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrict...
CVE-2026-6893 — A flaw was found in dracut (8.8 HIGH)