EUVD-2026-34874Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Termix as low-priv user
-
DeliveryEnumerate or guess active File Manager sessionId
-
ExploitBind to victim's File Manager session
-
ExecutionWrite payload to victim VPS filesystem
-
PersistExecute payload via File Manager
-
ImpactRCE on victim's remote VPS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a valid authenticated account on the target Termix instance (PR:L), (2) a concurrent victim with an active File Manager session open against their VPS (UI:R - the attack only works while a victim session is live), and (3) the ability to submit or guess a sessionId value accepted by the File Manager backend. Exploitation is limited to Termix deployments running a version prior to 2.3.2 in multi-user mode; single-user self-hosted Termix instances have no cross-tenant victim and are not practically exploitable for this bug. |
| Impact | Signals are largely aligned toward high real-world risk: CVSS 9.0 with AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H indicates a network-reachable bug with low complexity that needs only low privileges (any logged-in Termix user) and yields scope-changing high impact on another tenant's VPS. The UI:R requirement is unusual for this kind of access-control bug and likely reflects that the victim must have an active File Manager session open for the attacker to ride - that is a meaningful real-world limiter on continuous exploitation but does not reduce severity in multi-user deployments where File Manager use is routine. EPSS is not provided in the input and the CVE is not in CISA KEV, and no public PoC is referenced beyond the GHSA, so this is currently a high-severity, low-observed-exploitation issue. The principal uncertainty is whether the sessionId is guessable/enumerable or only obtainable via side-channel - the advisory describes 'manipulate the value', which suggests enumeration is feasible, but exact ID entropy is not confirmed in the provided data. |
| Exploit ScenarioDerived | An attacker registers or already holds a low-privileged account on a shared Termix instance, then issues File Manager API calls while iterating or guessing sessionId values until one resolves to another tenant's active SSH-backed File Manager session. Once attached, the attacker writes a payload to the victim's filesystem (for example, an authorized_keys entry or a cron job) and executes it through the File Manager's execute capability, achieving RCE on the victim's VPS under whatever account the victim's SSH session is connected as. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an authenticated low-privileged user to hijack another user's active File Manager session by tampering with a client-supplied sessionId, gaining full read/write/execute access to that victim's remote VPS over their established SSH connection. The CVSS 9.0 score reflects scope change (the compromised session crosses the trust boundary into the victim's separate VPS) and high impact across CIA. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the trivial nature of incrementing/guessing an unvalidated identifier makes exploitation straightforward once a foothold account exists.
RemediationAI
Vendor-released patch: upgrade Termix to version 2.3.2 or later, per advisory GHSA-cx2r-843c-vww8 (https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8). If immediate upgrade is not possible, restrict Termix to single-tenant use (one trusted user per instance) so cross-tenant session hijacking has no victim, or place the Termix UI behind an authenticating reverse proxy with per-user network segmentation; both trade off the multi-user collaboration model that Termix is designed for. Additionally invalidate all existing File Manager sessions after upgrade and rotate SSH credentials stored in Termix for any account that may have shared an instance with untrusted users, since pre-patch session hijacks would have given attackers interactive shell access on the targeted VPS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Termix is a self-hosted web platform (CPE cpe:2.3:a:termix-ssh:termix) that brokers SSH terminals, port-forward tunnels, and a File Manager backed by long-lived SSH sessions to user-supplied VPS instances. The flaw is a CWE-284 (Improper Access Control) issue: the File Manager backend uses a sessionId received from the client as the sole index for routing file operations to an underlying SSH channel, without checking that the sessionId is owned by the authenticated principal making the request. Because each sessionId is bound to a live SSH connection with full filesystem and shell capabilities on a remote host, the missing ownership check effectively turns a session identifier into a bearer token for somebody else's VPS - and because filesystem operations include write and execute, the access-control failure escalates trivially to RCE on the victim's remote machine.
Know when Termix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
1DescriptionGitHub Advisory
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.
Executive ViewAI
Termix versions prior to 2.3.2 enable authenticated users to hijack other users' active sessions, providing direct access to customers' remote infrastructure and data. No public exploit identified at time of analysis, but exploitation is straightforward once an authenticated account exists. Organizations deploying Termix should immediately assess their exposure and implement containment measures.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Termix File Manager access to necessary personnel only; require re-authentication for sensitive operations; segment SSH infrastructure from untrusted networks; deploy real-time alerting on anomalous session switching; consider temporary disabling of File Manager feature until patch availability confirmed; document and test incident response procedures for potential session hijacking.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated attackers can retrieve stored SSH host credentials - including addresses, usernames, and passwords - fro
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated lo
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticate
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system c
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-re
Exploit-DB