CVE-2026-45750: Termix OS Command Injection in File Manager Path Resolution

Overview

Termix is a web-based server management platform that includes an SSH terminal, tunneling and file editing. According to the record, the File Manager path resolution endpoint places a user-supplied path value inside a shell command that runs over the active SSH session. Only double quotes are escaped, so the remote shell can still interpret command substitution syntax. The weakness is classified as OS Command Injection (CWE-78).

Impact

• The record assigns a CVSS score of 9.0 (critical), with high confidentiality, integrity and availability impact and a network attack vector.
• The vector in the record indicates low privileges required and user interaction required.
• Successful exploitation would allow commands to run on the remote server with the privileges of the SSH session, according to the description and the impact metrics.
• The record's SSVC data lists technical impact as total and automatable as no.

Affected products and versions

• Termix (product entry Termix Termix): from 2.1.0 up to before 2.3.2.
• Termix-SSH (product entry Termix-SSH Termix): before 2.3.2.
• The record states that version 2.3.2 fixes the issue. The fixes list in the record is empty, so the fix is taken from the description and the release reference.

Exploitation status

The CVE is not listed in CISA KEV in the record, so active exploitation is not confirmed by that catalog. No confirmed exploitation in the wild appears in the sources consulted. The record's SSVC data gives an exploitation value of proof of concept, and one of the references is tagged as exploit-related. This analysis does not describe or evaluate any such material.

Remediation and mitigation

• Upgrade Termix to version 2.3.2 or later, as indicated by the Termix 2.3.2 release.
• Review the GitHub security advisory for the vendor's own description of the issue.
• Until the upgrade is applied, limit network access to the Termix interface to trusted users and networks, and reduce the privileges of the SSH accounts that Termix uses.
• After upgrading, confirm that the running version is 2.3.2 or later.

Detection guidance

• Review web server and application logs for unusual requests to the File Manager path resolution endpoint, especially requests with unexpected quoting or shell-related characters.
• Monitor SSH sessions opened by the Termix service for commands or child processes that do not match normal file management activity.
• These are high-level indicators only. The record does not provide validated detection signatures.

Limitations of the available information

• The record does not state the default configuration or whether the endpoint is exposed by default.
• The record does not describe the full set of conditions needed for exploitation beyond the CVSS vector and the description.
• The fixes list is empty in the record, so the fixed version relies on the description and the release reference.
• EPSS and SSVC values are included in the record, but their meaning for this specific deployment is not established.

Frequently asked questions

Which Termix versions are affected by CVE-2026-45750?

The record lists Termix from 2.1.0 up to before 2.3.2, and Termix-SSH before 2.3.2. The record states that version 2.3.2 fixes the issue.

What kind of vulnerability is this?

The record classifies it as OS Command Injection (CWE-78). The path value is placed in a shell command and only double quotes are escaped, so the remote shell can still interpret command substitution.

Is this CVE known to be actively exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation in the wild appears in the sources consulted. The record's SSVC data indicates a proof-of-concept exploitation status.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.