Read the docs
TI-2026-33481 Aliases CVE-2026-45744

Termix has an OS Command Injection in File Manager resolvePath endpoint

Priority HIGH 76CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02008 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Termix (Termix-SSH): 2.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Termix-SSHTermixbefore 2.3.22.3.2Patch availableCNA
  • Termix VendorTermix-SSH Affected before 2.3.2 Fixed in 2.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*2.1.0 to before 2.3.2VulnerableTermix-SSH
  • cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.3.2 Vulnerable ·Termix-SSH

Remediation

  • Fix · CNA Termix (Termix-SSH) Fixed in 2.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45744

References

Exploit 1

Other 1

  • TI-2026-33485 Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-37339 Termix' official Docker image contains an authentication bypass vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-33487 Termix Vulnerable to Arbitrary Command Execution in File Manager CVSS 3.1CRITICAL 9.0
  • TI-2026-33483 Termix Vulnerable to Arbitrary Command Execution via Session Hijacking CVSS 3.1CRITICAL 9.0
  • TI-2026-33486 Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password CVSS 3.1HIGH 8.1
  • TI-2026-33482 Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft CVSS 3.1HIGH 8.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences