Read the docs
TI-2026-33483 Aliases CVE-2026-45746

Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

Priority HIGH 74CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00387 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Termix (Termix-SSH): 2.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Termix-SSHTermixbefore 2.3.22.3.2Patch availableCNA
  • Termix VendorTermix-SSH Affected before 2.3.2 Fixed in 2.3.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*2.1.0 to before 2.3.2VulnerableTermix-SSH
  • cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.3.2 Vulnerable ·Termix-SSH

Remediation

  • Fix · CNA Termix (Termix-SSH) Fixed in 2.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45746

References

Exploit 1

  • TI-2026-33485 Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-37339 Termix' official Docker image contains an authentication bypass vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-33481 Termix has an OS Command Injection in File Manager resolvePath endpoint CVSS 3.1CRITICAL 9.9
  • TI-2026-33487 Termix Vulnerable to Arbitrary Command Execution in File Manager CVSS 3.1CRITICAL 9.0
  • TI-2026-33486 Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password CVSS 3.1HIGH 8.1
  • TI-2026-33482 Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft CVSS 3.1HIGH 8.0
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences