What is the CVSS score of EUVD-2026-34873?

EUVD-2026-34873 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Termix are affected by EUVD-2026-34873?

Termix web-based server management platform versions prior to 2.3.2 contain a critical command injection vulnerability (CVSS 9.9) enabling authenticated SSH File Manager users to execute arbitrary…. A patch is available.

How to fix or mitigate EUVD-2026-34873?

Within 24 hours: Audit all Termix deployments to identify systems running versions prior to 2.3.2; document all user accounts holding SSH File Manager access and assess criticality of managed infrastructure. Within 7 days: Restrict SSH File Manager feature access to only essential administrators; disable the feature entirely if operationally feasible; implement enhanced audit logging on /ssh/file_manager/ssh/resolvePath endpoint; isolate Termix platform on dedicated network segment with egress filtering. Within 30 days: Monitor vendor advisory GHSA-37f4-wq95-pg33 for patch release; upon availability, execute deployment plan to upgrade all affected Termix instances to version 2.3.2 or later.

Termix EUVD-2026-34873

| CVE-2026-45744 CRITICAL

OS Command Injection (CWE-78)

2026-06-05 GitHub_M

Command Injection Termix

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 05, 2026 - 20:02 EUVD

Source Code Evidence Fetched

Jun 05, 2026 - 18:35 vuln.today

Analysis Generated

Jun 05, 2026 - 18:35 vuln.today

DescriptionGitHub Advisory

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

AnalysisAI

Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticated user with an active File Manager SSH session to execute arbitrary OS commands on the connected remote host via the GET /ssh/file_manager/ssh/resolvePath endpoint. The vulnerability stems from improper shell escaping that fails to neutralize $(...) and backtick command substitution, yielding a CVSS 9.9 critical rating with scope change. No public exploit identified at time of analysis, but the vendor advisory (GHSA-37f4-wq95-pg33) provides sufficient technical detail to develop one trivially.

Technical ContextAI

Termix is an open-source web-based SSH server management platform offering terminal access, tunneling, and remote file editing across Windows, Linux, macOS, Android, and iOS (per CPE cpe:2.3:a:termix-ssh:termix). The flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command, aka OS Command Injection). The root cause is the resolvePath endpoint constructing shell commands by wrapping user-controlled input in double quotes - a sanitization approach that blocks naive quote-breaking but leaves shell metacharacters such as $(...) and ` ... ` (backtick command substitution) fully interpretable by POSIX shells like bash and sh. Because the command runs over an established SSH session, the injection executes on the remote managed host rather than the Termix server itself, which is reflected in the CVSS Scope:Changed (S:C) metric.

RemediationAI

Vendor-released patch: upgrade to Termix 2.3.2 or later, available at https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag with builds for Windows, Linux, and macOS. If immediate patching is not possible, compensating controls include restricting Termix account creation and tightly auditing the user list (since any authenticated user with an active File Manager session can exploit this), disabling the File Manager feature for non-essential users if the deployment supports per-user feature flags, and placing the Termix server behind a network reverse proxy that blocks or logs requests to the /ssh/file_manager/ssh/resolvePath endpoint - note that blocking that path will break legitimate path-resolution functionality in File Manager. Additionally, treat SSH target hosts as potentially compromised if any low-trust Termix user existed pre-patch, and review SSH session logs on managed hosts for anomalous command execution. Consult the vendor advisory at https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33 for further detail.