CVE-2026-45750 Details
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.
A critical vulnerability allowing arbitrary command execution has been identified in the Termix File Manager component, affecting versions through 2.1.0. The issue arises in the GET /ssh/file_manager/ssh/resolvePath endpoint, where the path parameter is improperly sanitized before being embedded in a shell command executed over an active SSH session. This flaw allows user-controlled input to be interpreted by the remote shell, particularly command substitution syntax, creating a risk of unauthorized command execution on the remote host.
Users can upgrade to Termix version 2.3.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag | [email protected] | ProductRelease Notes |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| termix termix | >= 2.1.0, < 2.3.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | Initial Analysis | [email protected] |
| Jun 5, 2026 | New CVE Received | [email protected] |