Termix EUVD-2026-114924

Requires a valid low-privilege authenticated session on the Termix web application (CVSS PR:L) and reachability of the file-manager plugin endpoint /plugin-api/file-manager/transferToHost; the attacker supplies a crafted destPath argument to escape the intended write directory. Applies to Termix up to 2.9.2 where the transfer engine honored the destPath shortcut; it is fixed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. Limiting factors: exploitation is not fully unauthenticated (an account/credential is needed), the file-manager plugin must be present and reachable, and the instance must be running a vulnerable version. Per the vendor history, updating to the fixed versions is the stated remedy; no vendor-provided mitigation is documented since the vendor did not respond to disclosure.

This is a credible near-term priority rather than a high-CVSS paper tiger, but the raw 8.6 should be read against weak corroboration. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw that requires only low-privilege authentication, and CWE-22 path traversal in a file-transfer endpoint plausibly yields the high integrity/availability impact claimed (arbitrary file write over SFTP to the target host). The vuln.today decision label is 'this_week', consistent with a serious-but-not-emergency triage. However, key amplifying signals are absent or soft: the CVE is NOT in CISA KEV, no EPSS exploitation-probability score is provided, and the only exploit artifact is a GitHub write-up referenced by VulDB that is not verified as working exploit code. The E:P (Proof-of-Concept) in the CVSS vector matches that PoC-reference status rather than confirmed active exploitation. The single originating source is VulDB, and the vendor did not respond to disclosure, so there is no vendor advisory to independently confirm the affected endpoint, the version range, or the fix. Net: treat as a genuine authenticated remote file-write risk warranting prompt patching on exposed Termix instances, while recognizing the evidence base is single-sourced and the real-world exploitation signal is PoC-level, not in-the-wild.

An attacker who holds a low-privilege account on an internet- or network-reachable Termix instance (up to 2.9.2) sends a request to /plugin-api/file-manager/transferToHost with a destPath value containing traversal sequences, causing a file to be written outside the intended directory on the target host. A public PoC reference exists but is not verified as working exploit code, so weaponization effort is still required. Because the write targets arbitrary host paths, a successful write (e.g. to a startup script, authorized_keys, or web root) can escalate to code execution.