CVE-2026-45746criticalCWE-284CWE-639

CVE-2026-45746: falha crítica em Termix-SSH Termix

Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Termix

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9epss 0.4%
da publicação à arma54 dias
Publicada no NVD5 de jun.
1ª PoC+54d
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
Termix-SSH · Termix
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Termix-SSH Termix

No mesmo produto, das mais perigosas para as menos.

CVE-2026-45744CRITICALTermix has an OS Command Injection in File Manager resolvePath endpointEPSS 2.0%CVE-2026-45748CRITICALTermix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command InjectionEPSS 1.7%CVE-2026-42453HIGHTermix: Command injection in extractArchive/compressFiles via double-quote escaping bypassEPSS 1.2%CVE-2026-53545CRITICALTermix: Remote Code Execution via Tunnel Disconnect pkill Command InjectionEPSS 0.7%CVE-2026-53542HIGHTermix: Tar option injection in file-manager archive creation allows command execution on managed SSH hostsEPSS 0.7%CVE-2026-42454CRITICALTermix: OS Command Injection in Docker Container Management EndpointsEPSS 0.7%