CVE-2026-45744 | Termix is a web-based server management platform with SSH te… | CVSS 9.9 CRITICAL

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

Metadata

CVE ID: CVE-2026-45744
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-13 06:54 UTC
Published: 2026-06-05 17:58 UTC
Last updated: 2026-06-10 03:58 UTC
Primary CWE: CWE-78
CWE-78: Improper Neutralization of Special Elements used in …
Vendor / Product: Termix-SSH / Termix
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Termix-SSH	Termix	—	< 2.3.2

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (2)

https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33 https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33
https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag