Vulnerability Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Termix | Termix | >= 2.1.0, < 2.3.2 |
Related Weaknesses (CWE)
References
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tagProductRelease Notes
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33ExploitMitigationVendor Advisory
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33ExploitMitigationVendor Advisory
FAQ
What is CVE-2026-45744?
CVE-2026-45744 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vu...
How severe is CVE-2026-45744?
CVE-2026-45744 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-45744?
Check the references section above for vendor advisories and patch information. Affected products include: Termix Termix.