CVE-2026-45744: Termix OS Command Injection in File Manager resolvePath
Termix, a web-based server management platform, contains an OS command injection flaw (CWE-78) in the File Manager resolvePath endpoint. An authenticated user with an active File Manager SSH session may run arbitrary commands on the connected remote host. The record states the issue is fixed in version 2.3.2 and assigns a critical CVSS score of 9.9.
Overview
Termix is a web-based server management platform with SSH terminal, tunneling and file editing features. The record describes an OS command injection flaw in the File Manager resolvePath endpoint, classified as CWE-78. According to the record, the endpoint builds shell commands using double-quote escaping, which does not prevent command substitution.
Impact
- An authenticated user with an active File Manager SSH session can run arbitrary commands on the connected remote host.
- The CVSS score of 9.9 reflects network reachability, low privileges required, a scope change and high impact on confidentiality, integrity and availability.
- The SSVC data in the record lists technical impact as total and automatable as no.
Affected products and versions
- Termix (product entry 'Termix Termix'): from 2.1.0 up to but not including 2.3.2.
- Termix-SSH Termix (product entry 'Termix-SSH Termix'): versions before 2.3.2.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, so this analysis does not state active exploitation. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as poc, and the vendor advisory carries an exploit-related tag in the reference list, but this analysis does not describe or reproduce any exploit. EPSS is 0.0299 with a percentile of 0.87235 as of 2026-10-23.
Remediation and mitigation
- Upgrade Termix to version 2.3.2 or later, which the record states patches the issue.
- Review the vendor advisory and release notes linked in the references for the exact fix and any further guidance.
- Until patching is complete, limit which accounts can open File Manager SSH sessions and reduce the number of active sessions.
- Apply least privilege to the SSH accounts that Termix uses on remote hosts.
Detection guidance
- Review application and web logs for File Manager requests to resolvePath from unexpected users or sources, paying attention to unusual input values.
- Monitor remote hosts for unexpected processes started under the SSH accounts used by Termix.
- Correlate File Manager session activity with authentication logs to spot sessions that do not match normal use.
Limitations of the available information
- The record does not state whether versions before 2.1.0 are affected.
- The record does not describe a workaround; the fix entry is labelled mitigation and points to the vendor advisory.
- Public exploit code availability is unknown beyond the exploit-related tag and the SSVC value.
- The record does not confirm whether the two product entries cover the same deployments.
Frequently asked questions
Which Termix versions are affected?
The record lists Termix from 2.1.0 up to but not including 2.3.2, and Termix-SSH Termix before 2.3.2. Whether older versions are affected is unknown from the record.
Is this vulnerability being actively exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as poc.
What should administrators do first?
Upgrade Termix to version 2.3.2 or later, review who can open File Manager SSH sessions, and apply least privilege to SSH accounts used on remote hosts.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.