EUVD-2026-34872Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Termix instance
-
DeliveryEnumerate or guess victim sessionId
-
ExploitCall file-manager endpoint with victim sessionId
-
ExecutionRead, write, or execute files on victim SSH host
-
ImpactExfiltrate data or pivot further
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires an authenticated Termix account on the target instance (PR:L) and the existence of at least one other user with an active SSH session whose |
| Impact | The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) signals network reach, low complexity, low-privilege authenticated attacker, no user interaction, and high impact on confidentiality and integrity - consistent with an authenticated tenant abusing missing authorization to reach another tenant's SSH host. The exploit is straightforward (call the endpoint with a guessed or observed sessionId), making this realistically automatable in multi-user deployments. EPSS and KEV data were not provided in the input, and there is no public exploit identified at time of analysis, so this is not currently known to be widespread exploitation; however, the bar - any logged-in user - is low, and the impact (arbitrary file ops and execution on another user's SSH target) is severe. The vector lists A:N, which is conservative given that an attacker can delete or overwrite files; defenders in shared deployments should treat this as a high real-world priority rather than a paper CVSS finding. |
| Exploit ScenarioDerived | A low-privileged user with a legitimate Termix account logs in, opens their own SSH session to obtain a sample sessionId, then enumerates or guesses sessionId values belonging to other active users and issues file-manager API calls (read, write, delete, download, execute) against those sessions. Because Termix never verifies session ownership, the attacker's commands run with the victim's SSH credentials on the victim's connected host, allowing data theft, file tampering, or arbitrary command execution on production servers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Cross-tenant SSH session hijacking in Termix versions prior to 2.3.2 allows any authenticated user to fully control another user's connected SSH host via predictable session identifiers. Sixteen file-manager endpoints fail to verify ownership of the sessionId parameter, enabling read, write, delete, download, and execute operations on victim hosts. No public exploit identified at time of analysis, but the multi-tenant deployment model and low attack complexity make this a high-priority issue for shared installations.
RemediationAI
Vendor-released patch: upgrade to Termix release-2.3.2 or later, available from https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag, which adds the missing ownership checks on the 16 file-manager endpoints per GHSA-5fqh-77cr-jj5x. If immediate upgrade is not possible, restrict the Termix instance to a single trusted user or place it behind a reverse proxy that limits which authenticated accounts can reach the file-manager API paths - note that this defeats Termix's multi-user value proposition. As an interim measure, terminate long-lived SSH sessions promptly to shrink the window during which a valid sessionId could be guessed or harvested, accepting the usability cost of forcing reconnections, and audit existing accounts to remove any not strictly required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Termix is a self-hosted web-based server management platform that brokers SSH terminal access, tunneling, and file editing through a browser frontend. The flaw is a classic CWE-639 (Authorization Bypass Through User-Controlled Key) - sixteen file-manager API endpoints accept a sessionId parameter to identify which SSH session to operate against, but never check that the calling user actually owns that session. Because SSH sessions in Termix represent already-authenticated connections to backend hosts, abusing someone else's session inherits their SSH privileges on the target server, effectively turning a missing authorization check into remote command execution on third-party infrastructure. The affected CPE is cpe:2.3:a:termix-ssh:termix prior to 2.3.2.
Know when Termix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by sessionId. An authenticated attacker who knows or guesses another user's active sessionId can read, write, delete, download, and execute files on the victim's connected SSH host. Version 2.3.2 patches the issue.
Executive ViewAI
Termix versions prior to 2.3.2 allow any authenticated user to hijack other users' SSH sessions and execute commands on their hosts in multi-tenant deployments, creating direct risk of cross-tenant data exposure and infrastructure compromise. This vulnerability affects all organizations using shared Termix infrastructure where multiple customers or teams authenticate to the same instance. Immediate action is required to prevent unauthorized SSH access and data theft between tenants.
No vendor-released patch identified at time of analysis. Deploy interim mitigations: (1) Implement network segmentation with firewall rules isolating SSH sessions by tenant; (2) Enforce API authentication and add authorization checks on file-manager endpoints; (3) Disable vulnerable endpoints where business needs permit; (4) Deploy enhanced logging on sessionId parameter usage and SSH session lifecycle; (5) Implement session binding to source IP and device; (6) Conduct immediate forensic review of SSH access logs for exploitation indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated attackers can retrieve stored SSH host credentials - including addresses, usernames, and passwords - fro
Path traversal in Termix (Termix-SSH) up to 2.9.2 lets a remote attacker who holds a valid low-privilege account write f
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated lo
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticate
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system c
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an a
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Exploit-DB