CVE-2026-45750
criticalpriority · track · 0EPSS 0.003 · 22 %ileEUUSEPSS · scored 2026-10-26
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.2–9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-45750cnnvd
- https://github.com/Termix-SSH/Termix/releasesPatchcnnvd
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tagcnnvd
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72cnnvd
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tagenisa_euvd
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72enisa_euvd
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tagProductRelease Notesnvd
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-v26q-rpv5-9m72ExploitVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan