What is the CVSS score of CVE-2026-45750?

CVE-2026-45750 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Termix are affected by CVE-2026-45750?

Termix server management platform versions before 2.3.2 contain a critical command injection flaw in the File Manager's resolvePath endpoint that allows authenticated users to execute arbitrary shell…. A patch is available.

How to fix or mitigate CVE-2026-45750?

24 hours: Inventory all Termix deployments and versions; immediately restrict File Manager access to essential administrators only; audit recent access logs for exploitation attempts. 7 days: Establish continuous monitoring for suspicious File Manager operations and command-like syntax in resolvePath parameters. 30 days: No vendor-released patch identified at time of analysis-monitor GHSA-v26q-rpv5-9m72 for patch availability; if unavailable within 60 days, evaluate alternative server management platforms or deploy in isolated network segments with restricted downstream connectivity.

Termix CVE-2026-45750

EUVD-2026-34878 CRITICAL

OS Command Injection (CWE-78)

2026-06-05 GitHub_M

Command Injection Termix

9.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.0 CRITICAL

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 05, 2026 - 18:37 vuln.today

Analysis Generated

Jun 05, 2026 - 18:37 vuln.today

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.

AnalysisAI

Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitrary shell commands on remote SSH-managed hosts via the File Manager's resolvePath endpoint. The flaw stems from incomplete shell escaping that only handles double quotes while leaving command substitution syntax interpretable. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-v26q-rpv5-9m72) and CVSS 9.0 rating signal high impact across confidentiality, integrity, and availability of downstream SSH targets.

Technical ContextAI

Termix (cpe:2.3:a:termix-ssh:termix) is a web-based SSH management platform providing browser-accessible terminal, tunneling, and file editing functionality against remote hosts. The vulnerability is a classic CWE-78 (OS Command Injection) where the GET /ssh/file_manager/ssh/resolvePath handler takes a user-supplied 'path' parameter and concatenates it into a shell command string sent over an active SSH session. The sanitizer escapes only double quote characters but leaves shell metacharacters such as $(...) untouched, so command substitution executes on the remote host even though the value sits inside a double-quoted argument - a textbook example of insufficient shell-metacharacter neutralization.

RemediationAI

Vendor-released patch: upgrade Termix to version 2.3.2 or later, available from https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag for Windows, Linux (x64 and ARM64), and macOS. Until the upgrade is applied, restrict Termix accounts to fully trusted operators only, block external network reach to the Termix web UI via firewall or reverse-proxy ACLs, and avoid configuring SSH credentials for high-value hosts inside Termix because any logged-in user can pivot through the file manager; note these controls reduce but do not eliminate insider risk and break legitimate multi-user collaboration workflows. Review the GitHub Security Advisory GHSA-v26q-rpv5-9m72 for any additional vendor guidance.