CVE-2026-79766 Details
Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.
A critical command injection vulnerability has been identified in Termix, a web-based server management platform, versions 2.4.1 prior to 2.5.1. The issue allows authenticated administrators to execute arbitrary operating system commands on the server host where Termix is running, including the Docker container in default deployments. This vulnerability arises because the ACME SSL request handler interpolates admin-controlled domain and email values into a shell command without proper escaping, leaving the application open to injection attacks. The flaw is present in both HTTP webroot and DNS Cloudflare challenge modes, and exploitation can lead to unauthorized access to sensitive data, including Termix databases, process secrets, stored credentials, and network reachability.
Users can update to Termix version 2.5.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Termix-SSH/Termix/commit/c7a9063a72071153723e668787548766c971f029 | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e | [email protected] | Source CodeVendor |
| https://github.com/Termix-SSH/Termix/pull/1067 | [email protected] | Issue TrackingVendor |
| https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag | [email protected] | Release NotesVendor |
| https://github.com/Termix-SSH/Termix/security/advisories/GHSA-pr55-25gf-5f9v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Termix | >= 2.4.1, < 2.5.1 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |