EUVD-2026-86254Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate, credible-but-not-urgent SSRF. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L, 6.4) matches the description well: network-reachable, low complexity, but requires an authenticated account (PR:L) on the Termix instance and yields only limited integrity/availability impact against internal services (I:L/A:L) with no confidentiality gain (C:N) because it is BLIND - response bodies are not returned. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis.' The scope change (S:C) is justified: the flaw lets the Termix server pivot to internal HTTP services beyond the app's own authority. Realistic priority is tempered by three factors that all point the same direction: authentication is required, the SSRF is blind (no data exfil of response contents), and Termix is a niche self-hosted product. Net: patch it, but it is a defense-in-depth/internal-pivot risk rather than a mass-exploitation emergency. No key signals are conflicting; the CVSS and description are consistent. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Server-side request forgery in Termix 2.5.0 lets authenticated users make the Termix server issue outbound HTTP requests to arbitrary destinations, including internal services that are normally unreachable from outside the host network. An attacker with a low-privileged account can register a webhook or ntfy notification channel pointing at an internal address and then trigger it through the notification-channel test endpoint, which reaches the request-sending code in src/backend/utils/notification-sender.ts without any destination allowlisting or private-address blocking. Because webhook mode also honors attacker-chosen HTTP methods and headers, the requests are blind but not strictly read-only: an internal service that accepts the fixed notification body may still change state, though response bodies are never returned to the attacker. No public exploit code has been identified at time of analysis and the issue is fixed in version 2.5.1.
RemediationAI
Upgrade Termix to version 2.5.1 (release-2.5.1-tag), which is the vendor-released patch that adds destination allowlisting and private-address blocking in the notification send path; the change is referenced from advisory GHSA-6hx3-9mgq-h9fj, pull request Termix-SSH/Termix#1067 and commits ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e and e1d1a3e53d65794ec2f23099bafe77fdfdd11648. If immediate upgrade is not possible, the most effective compensating control is to constrain what the Termix server can reach: place it in a network segment with egress restricted by firewall or an outbound proxy allowlist so that loopback, link-local and RFC1918 destinations cannot be contacted, accepting that this will also break any legitimate internal notification targets until they are explicitly permitted. Restrict who can create or edit webhook and ntfy notification channels to trusted administrators, and disable the notification-channel test endpoint if it is not required, noting that both measures reduce or remove alerting functionality. Running Termix in an isolated container or DMZ with no routing to management interfaces, admin panels or cloud metadata endpoints limits the blast radius of a successful forgery but will prevent legitimate access to internal services. Note that blocking egress alone is a containment measure, not a fix, and that internal services should not be assumed safe just because responses are not returned to the attacker - the requests are still delivered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This is a classic CWE-918 server-side request forgery in the Node/TypeScript backend of Termix, a web-based server management platform offering SSH terminals, tunneling and file editing. The vulnerable flow starts at the alert-rules route module (src/backend/database/routes/alert-rules-routes.ts), which accepts user-supplied notification-channel configuration - including the destination URL for webhook and ntfy channels - and passes it to the shared sender in src/backend/utils/notification-sender.ts. That sender performs the HTTP request without validating the target host against an allowlist or rejecting loopback, link-local and RFC1918 private ranges, so the Termix process itself becomes the request proxy. The scope-changed rating (S:C in the CVSS vector) reflects that the impact crosses a trust boundary: the vulnerable component is exploited to reach resources on the internal network that the component is not authorized to represent. Impact is deliberately limited - no confidentiality impact (C:N) because response bodies are not reflected back, low integrity impact because attacker-controlled HTTP verbs and headers may cause limited state changes in services that accept the fixed notification payload, and low availability impact. The CPE entry cpe:2.3:a:termix-ssh:termix:*:*:*:*:*:*:*:* identifies the affected product family, with the vulnerable window being 2.5.0 up to, but not including, 2.5.1.
Know when Termix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Unauthenticated attackers can retrieve stored SSH host credentials - including addresses, usernames, and passwords - fro
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary Ja
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticat
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenti
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated lo
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticate
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system c
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an a
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitr
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-
Exploit-DB