Termix EUVD-2026-34872

Requires an authenticated Termix account on the target instance (PR:L) and the existence of at least one other user with an active SSH session whose sessionId the attacker can learn or guess; exploitation targets the 16 file-manager endpoints in Termix versions before 2.3.2. No user interaction is needed from the victim beyond having an open SSH session, and no special non-default configuration is required - the missing authorization check is present in default deployments. Single-user installations are not meaningfully exposed because there are no foreign sessions to hijack, which is the primary natural limiter.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) signals network reach, low complexity, low-privilege authenticated attacker, no user interaction, and high impact on confidentiality and integrity - consistent with an authenticated tenant abusing missing authorization to reach another tenant's SSH host. The exploit is straightforward (call the endpoint with a guessed or observed sessionId), making this realistically automatable in multi-user deployments. EPSS and KEV data were not provided in the input, and there is no public exploit identified at time of analysis, so this is not currently known to be widespread exploitation; however, the bar - any logged-in user - is low, and the impact (arbitrary file ops and execution on another user's SSH target) is severe. The vector lists A:N, which is conservative given that an attacker can delete or overwrite files; defenders in shared deployments should treat this as a high real-world priority rather than a paper CVSS finding.

A low-privileged user with a legitimate Termix account logs in, opens their own SSH session to obtain a sample sessionId, then enumerates or guesses sessionId values belonging to other active users and issues file-manager API calls (read, write, delete, download, execute) against those sessions. Because Termix never verifies session ownership, the attacker's commands run with the victim's SSH credentials on the victim's connected host, allowing data theft, file tampering, or arbitrary command execution on production servers.