TI-2026-83673 Aliases CVE-2026-120322 GHSA-49pf-hq35-qwjq

Path traversal in Termix-SSH Termix file transfer

HIGH 76CWE-22Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Termix-SSH Termix up to 2.9.2 contains a path traversal flaw (CWE-22) in the transferToHost file transfer endpoint. The destPath argument is not restricted to an intended directory, so a remote attacker with low privileges can reach paths outside it without user interaction. A public exploit is available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00618 49th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Termix-SSH	Termix	2.9.0; 2.9.1; 2.9.2	—	No fix listed	CNA

Termix VendorTermix-SSH Affected 2.9.0; 2.9.1; 2.9.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:termix-ssh:termix::::::::	—	—	—

cpe:2.3:a:termix-ssh:termix:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for Termix. The source description says the shortcut was removed in standalone File Manager plugin v1.0.0 and in core v26.10.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

2026-11-02 Threatist record created from CVE-2026-120322
2026-11-02 Alias added: GHSA-49pf-hq35-qwjq
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: MEDIUM → HIGH

References

Exploit 1

https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md

TI-2026-33485 Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection CVSS 3.1CRITICAL 9.8
TI-2025-37339 Termix' official Docker image contains an authentication bypass vulnerability CVSS 4.0CRITICAL 9.2
TI-2026-38619 Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users CVSS 3.1CRITICAL 9.6
TI-2026-38617 Termix: Missing authorization in SSH host credential resolution exposes stored credentials CVSS 3.1CRITICAL 9.6
TI-2026-33481 Termix has an OS Command Injection in File Manager resolvePath endpoint CVSS 3.1CRITICAL 9.9
TI-2026-55243 Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email CVSS 3.1CRITICAL 9.1

See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences