Termix
Monthly
Server-side request forgery in Termix 2.5.0 allows an authenticated user - including a self-registered low-privilege account where open registration is enabled - to make the Termix backend fetch arbitrary internal URLs through the /homepage/proxy endpoint. Because the handler JSON-parses the fetched body and returns the complete response to the caller, an attacker can reach loopback, RFC1918, link-local and cloud metadata destinations (notably 169.254.169.254) and exfiltrate internal service data and cloud credentials. The vulnerable code path existed only in the narrow 2.5.0-to-2.5.1 window, is fixed in 2.5.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system commands as the Termix backend process by storing crafted domain and email values via PATCH /users/acme-ssl-settings and then triggering their interpolation into a certbot shell invocation through POST /users/acme-ssl-request. Successful exploitation exposes Termix databases, process secrets, stored credentials, and the backend's network reachability, with both HTTP-webroot and DNS-Cloudflare challenge modes affected. The issue is fixed in 2.5.1; no public exploit code has been identified at time of analysis, and the practical risk is bounded by the requirement for a high-privileged (administrator) account rather than being reachable pre-authentication.
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. Commands execute on the source SSH host with the privileges of the connected SSH account. No public exploit identified at time of analysis; fixed in 2.3.2.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Server-Side Request Forgery in Termix prior to 2.3.2 allows authenticated users to weaponize the proxy connectivity test endpoint as an internal network scanner and cloud credential harvester. The POST /host/db/proxy/test endpoint blindly forwards raw TCP and SOCKS connections to attacker-controlled addresses supplied via singleProxy, proxyChain, and testTarget fields, enabling traversal to localhost services, RFC-1918 private networks, and link-local cloud metadata endpoints such as 169.254.169.254. Structured connection error responses and timing data leak host reachability, and successful metadata service access directly exposes cloud provider IAM credentials usable for lateral movement. No public exploit is identified at time of analysis, but the attack is trivially reproducible given the granular advisory disclosure.
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitrary shell commands on remote SSH-managed hosts via the File Manager's resolvePath endpoint. The flaw stems from incomplete shell escaping that only handles double quotes while leaving command substitution syntax interpretable. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-v26q-rpv5-9m72) and CVSS 9.0 rating signal high impact across confidentiality, integrity, and availability of downstream SSH targets.
Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated attackers to execute arbitrary commands on the source SSH host via the POST /ssh/tunnel/connect endpoint. The flaw stems from user-controlled host record fields being interpolated directly into shell commands without escaping, yielding persistent code execution. No public exploit identified at time of analysis, but a vendor-released patch is available in version 2.3.2.
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an authenticated low-privileged user to hijack another user's active File Manager session by tampering with a client-supplied sessionId, gaining full read/write/execute access to that victim's remote VPS over their established SSH connection. The CVSS 9.0 score reflects scope change (the compromised session crosses the trust boundary into the victim's separate VPS) and high impact across CIA. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the trivial nature of incrementing/guessing an unvalidated identifier makes exploitation straightforward once a foothold account exists.
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticated user with an active File Manager SSH session to execute arbitrary OS commands on the connected remote host via the GET /ssh/file_manager/ssh/resolvePath endpoint. The vulnerability stems from improper shell escaping that fails to neutralize $(...) and backtick command substitution, yielding a CVSS 9.9 critical rating with scope change. No public exploit identified at time of analysis, but the vendor advisory (GHSA-37f4-wq95-pg33) provides sufficient technical detail to develop one trivially.
Cross-tenant SSH session hijacking in Termix versions prior to 2.3.2 allows any authenticated user to fully control another user's connected SSH host via predictable session identifiers. Sixteen file-manager endpoints fail to verify ownership of the `sessionId` parameter, enabling read, write, delete, download, and execute operations on victim hosts. No public exploit identified at time of analysis, but the multi-tenant deployment model and low attack complexity make this a high-priority issue for shared installations.
Machine-in-the-middle interception of HTTPS traffic in Termix Desktop (Electron) starting at version 1.7.0 allows attackers positioned on the network path to steal login credentials and JWT/session tokens because the Electron client disables TLS certificate validation entirely. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 8.0 rating with scope-change and the absence of any vendor-released patch make this a meaningful concern for any user running Termix Desktop on untrusted networks.
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenticated user run arbitrary OS commands on any managed remote server. The Docker container-management endpoints pass the attacker-controlled containerId (from the URL path and WebSocket messages) straight into shell commands run over SSH via ssh2.Client.exec() with no sanitization, so a crafted container ID achieves full command injection. Rated CVSS 9.9 with no public exploit identified at time of analysis; EPSS is very low (0.07%) and it is not on CISA KEV.
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers execute arbitrary OS commands on managed remote SSH hosts. The extractArchive and compressFiles endpoints in file-manager.ts build shell commands using double-quoted strings, which — unlike the single-quote escaping used everywhere else in the file manager — permit $(command) substitution in attacker-controlled input. SSVC classifies exploitation as PoC-stage (publicly available exploit code exists), it is not in CISA KEV, and EPSS is low (0.16%, 37th percentile), indicating no observed widespread exploitation; the flaw is fixed in 2.1.0.
Authentication bypass in Termix (self-hosted SSH web management platform) before version 2.1.0 lets an attacker who knows only a victim's password bypass TOTP two-factor authentication. The /users/login endpoint issues a temporary JWT (temp_token) carrying a pendingTOTP state that should only unlock the second-factor step, but the auth middleware wrongly accepts this token on fully authenticated endpoints, collapsing 2FA into single-factor password authentication for every TOTP-enabled account. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS probability is very low (0.01%, 1st percentile) and there is no evidence of active exploitation.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary JavaScript by uploading malicious SVG files that bypass content sanitization. When a Termix user previews the crafted file, the payload executes within the application context with full access to sensitive operations. Public exploit code exists and no patch is currently available.
Termix 2.4.0 through 2.5.0 permits an attacker who already holds a victim's authenticated session and knows the account password to disable TOTP two-factor authentication or regenerate (and thereby invalidate) the victim's backup codes through POST /users/totp/disable and POST /users/totp/backup-codes, degrading the account to single-factor authentication. The defect is a regression of the fix originally shipped for CVE-2026-45749: a 2.4.0 refactor made verifyTotpReauth accept a bcrypt-validated password as an interchangeable substitute for a TOTP code, so no authenticator or valid second factor is needed. Scored CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and tracked as EUVD-2026-86120, this is a conditional security-degradation flaw rather than a high-urgency issue - the attacker cannot reach the endpoints without an active authenticated session (PR:L) and must separately know the plaintext password (driving AC:H), and the outcome is a weakened authentication posture (integrity impact only) with no confidentiality or availability impact. Vendor-released patch: 2.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Offline recovery of stored SSH secrets is possible in Termix 1.7.0 through 2.5.0 because the keys that wrap OIDC and WebAuthn users' Data Encryption Keys are derived from committed default strings rather than operator-supplied secrets. An attacker who obtains a copy of the SQLite database - through an exposed or stolen backup, filesystem access, or a separate exfiltration bug - can recompute the wrapping key from the static default value plus the public userId salt, unwrap each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases; password-authenticated users are not affected by this derivation path. Vendor-released patch: 2.5.1. No public exploit code has been identified at time of analysis, and because the attacker must already hold the database file, this is an access-gated local data-confidentiality flaw (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) rather than a network-facing issue.
Authenticated Termix users can abuse the POST /credentials/:id/deploy-to-host endpoint to reach other users' credential and host records, because the server resolves attacker-supplied credentialId and targetHostId integers without verifying ownership. On instances running 1.7.0 through 2.5.0, this yields limited information disclosure (whether a record exists and its authType) and lets an attacker cause a victim host that authenticates by key to make an outbound SSH connection attempt using the attacker's public key; encrypted passwords and private keys are never exposed, keeping impact consistent with the assessed CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit identified at time of analysis, and the vendor fixed the authorization check in version 2.5.1.
Command injection in Termix's SSH key deployment flow affects versions 1.7.0 through 2.5.0 and lets an authenticated user with high privileges execute arbitrary commands with the selected remote account's privileges by supplying a crafted public-key token that breaks out of a double-quoted grep -F shell command. The independent assessment rates confidentiality, integrity, and availability impact as high with scope changed because code runs on the target host, not merely the Termix server; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2.5.1.
Termix versions 1.8.0 through 2.5.1 expose server-stats API routes that lack per-host authorization, allowing any authenticated user to read host online/offline state and lastChecked timestamps for hosts they cannot access and to clear the instance-wide SSH connection pool. Because GET /status/:id accepts an attacker-supplied numeric host identifier, a low-privileged account can enumerate host IDs (IDOR), while POST /clear-connections disrupts other users' active sessions and pooled connections. Unauthenticated requests remain blocked and no public exploit code has been identified at time of analysis; CVSS is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) and the vendor fixed the issue in 2.5.1.
Server-side request forgery in Termix 2.5.0 lets authenticated users make the Termix server issue outbound HTTP requests to arbitrary destinations, including internal services that are normally unreachable from outside the host network. An attacker with a low-privileged account can register a webhook or ntfy notification channel pointing at an internal address and then trigger it through the notification-channel test endpoint, which reaches the request-sending code in src/backend/utils/notification-sender.ts without any destination allowlisting or private-address blocking. Because webhook mode also honors attacker-chosen HTTP methods and headers, the requests are blind but not strictly read-only: an internal service that accepts the fixed notification body may still change state, though response bodies are never returned to the attacker. No public exploit code has been identified at time of analysis and the issue is fixed in version 2.5.1.
Unauthenticated attackers can retrieve stored SSH host credentials - including addresses, usernames, and passwords - from Termix deployments running version 1.5.0 and below when the platform is served behind an Nginx reverse proxy, which is the default for the official Docker image and the official Dockerfile. The proxy causes the backend's req.ip to resolve to the proxy's own address instead of the real client, so the isLocalhost check always evaluates true and the /ssh/db/host/internal endpoint is reachable without login; publicly available exploit code exists and the flaw is fixed in version 1.6.0. Exploitation is unauthenticated (CVSS 4.0 vector PR:N) and requires no user interaction, but it is deployment-topology dependent - a Termix instance not behind a reverse proxy, where req.ip reflects the true client, should not be exposed in this way. EPSS is low (0.06%, 19th percentile) and there is no CISA KEV confirmation of active exploitation at time of analysis.
Server-side request forgery in Termix 2.5.0 allows an authenticated user - including a self-registered low-privilege account where open registration is enabled - to make the Termix backend fetch arbitrary internal URLs through the /homepage/proxy endpoint. Because the handler JSON-parses the fetched body and returns the complete response to the caller, an attacker can reach loopback, RFC1918, link-local and cloud metadata destinations (notably 169.254.169.254) and exfiltrate internal service data and cloud credentials. The vulnerable code path existed only in the narrow 2.5.0-to-2.5.1 window, is fixed in 2.5.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Command injection in Termix 2.4.1 through 2.5.0 lets an authenticated administrator execute arbitrary operating-system commands as the Termix backend process by storing crafted domain and email values via PATCH /users/acme-ssl-settings and then triggering their interpolation into a certbot shell invocation through POST /users/acme-ssl-request. Successful exploitation exposes Termix databases, process secrets, stored credentials, and the backend's network reachability, with both HTTP-webroot and DNS-Cloudflare challenge modes affected. The issue is fixed in 2.5.1; no public exploit code has been identified at time of analysis, and the practical risk is bounded by the requirement for a high-privileged (administrator) account rather than being reachable pre-authentication.
OS command injection in Termix (self-hosted web SSH/tunneling platform) before 2.3.2 lets an authenticated user who can edit a tunnel's host fields achieve arbitrary command execution. Attacker-controlled values (endpointPort, sourcePort, endpointUsername, endpointIP) are interpolated into single-quoted pkill -f patterns in src/backend/ssh/tunnel.ts, so a single quote breaks out of the pattern and appends a shell command that runs when DELETE /ssh/tunnel/disconnect/:tunnelName tears the tunnel down. Commands execute on the source SSH host with the privileges of the connected SSH account. No public exploit identified at time of analysis; fixed in 2.3.2.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Remote command injection in Termix, a web-based SSH server management platform, allows any authenticated user with file-manager access to execute arbitrary commands on a managed SSH host prior to version 2.3.2. The archive creation endpoint in src/backend/ssh/file-manager.ts passes user-supplied file basenames directly to GNU tar without an end-of-options delimiter, enabling an attacker to supply filenames matching tar checkpoint options (e.g., --checkpoint=1, --checkpoint-action=exec=<cmd>) that tar interprets as directives rather than operands. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but the exploitation technique is well-documented and the CVSS score of 8.8 reflects genuine high-priority risk for all pre-2.3.2 deployments.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Unauthorized data exposure in Termix prior to 2.3.2 allows a low-privileged authenticated user to exfiltrate password-reset tokens belonging to other local accounts via the POST /database/export endpoint, enabling full account takeover of any local user including administrators. The database export is intended to be user-scoped but incorrectly includes the global settings table, which stores transient reset_code_ and temp_reset_token_ artifacts from incomplete or historical password-reset flows. With CVSS 8.8 (PR:L, C:H/I:H/A:H) and a public GitHub advisory, this represents a high-severity privilege escalation path in deployments where multiple user accounts exist. No public exploit identified at time of analysis; vendor-released patch is available.
Server-Side Request Forgery in Termix prior to 2.3.2 allows authenticated users to weaponize the proxy connectivity test endpoint as an internal network scanner and cloud credential harvester. The POST /host/db/proxy/test endpoint blindly forwards raw TCP and SOCKS connections to attacker-controlled addresses supplied via singleProxy, proxyChain, and testTarget fields, enabling traversal to localhost services, RFC-1918 private networks, and link-local cloud metadata endpoints such as 169.254.169.254. Structured connection error responses and timing data leak host reachability, and successful metadata service access directly exposes cloud provider IAM credentials usable for lateral movement. No public exploit is identified at time of analysis, but the attack is trivially reproducible given the granular advisory disclosure.
Command injection in Termix server management platform before version 2.3.2 allows authenticated users to execute arbitrary shell commands on remote SSH-managed hosts via the File Manager's resolvePath endpoint. The flaw stems from incomplete shell escaping that only handles double quotes while leaving command substitution syntax interpretable. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-v26q-rpv5-9m72) and CVSS 9.0 rating signal high impact across confidentiality, integrity, and availability of downstream SSH targets.
Authentication bypass of MFA in Termix versions prior to 2.3.2 allows an attacker who already holds a victim's account password to disable TOTP or regenerate backup codes via the POST /users/totp/disable and POST /users/totp/backup-codes endpoints, completely neutralizing the second factor. The flaw stems from these MFA-critical endpoints accepting the account password as the sole authentication factor, meaning credential stuffing, phishing, or a leaked password hash (referenced as GHSA-xxxx) is sufficient to defeat 2FA. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OS command injection in Termix web-based server management platform prior to version 2.3.2 allows remote unauthenticated attackers to execute arbitrary commands on the source SSH host via the POST /ssh/tunnel/connect endpoint. The flaw stems from user-controlled host record fields being interpolated directly into shell commands without escaping, yielding persistent code execution. No public exploit identified at time of analysis, but a vendor-released patch is available in version 2.3.2.
Cross-tenant remote code execution in Termix (web-based SSH/file management platform) prior to version 2.3.2 allows an authenticated low-privileged user to hijack another user's active File Manager session by tampering with a client-supplied sessionId, gaining full read/write/execute access to that victim's remote VPS over their established SSH connection. The CVSS 9.0 score reflects scope change (the compromised session crosses the trust boundary into the victim's separate VPS) and high impact across CIA. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, but the trivial nature of incrementing/guessing an unvalidated identifier makes exploitation straightforward once a foothold account exists.
Remote command execution in Termix web-based server management platform (versions prior to 2.3.2) allows any authenticated user with an active File Manager SSH session to execute arbitrary OS commands on the connected remote host via the GET /ssh/file_manager/ssh/resolvePath endpoint. The vulnerability stems from improper shell escaping that fails to neutralize $(...) and backtick command substitution, yielding a CVSS 9.9 critical rating with scope change. No public exploit identified at time of analysis, but the vendor advisory (GHSA-37f4-wq95-pg33) provides sufficient technical detail to develop one trivially.
Cross-tenant SSH session hijacking in Termix versions prior to 2.3.2 allows any authenticated user to fully control another user's connected SSH host via predictable session identifiers. Sixteen file-manager endpoints fail to verify ownership of the `sessionId` parameter, enabling read, write, delete, download, and execute operations on victim hosts. No public exploit identified at time of analysis, but the multi-tenant deployment model and low attack complexity make this a high-priority issue for shared installations.
Machine-in-the-middle interception of HTTPS traffic in Termix Desktop (Electron) starting at version 1.7.0 allows attackers positioned on the network path to steal login credentials and JWT/session tokens because the Electron client disables TLS certificate validation entirely. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 8.0 rating with scope-change and the absence of any vendor-released patch make this a meaningful concern for any user running Termix Desktop on untrusted networks.
Remote code execution in Termix (self-hosted web-based server management platform) before version 2.1.0 lets an authenticated user run arbitrary OS commands on any managed remote server. The Docker container-management endpoints pass the attacker-controlled containerId (from the URL path and WebSocket messages) straight into shell commands run over SSH via ssh2.Client.exec() with no sanitization, so a crafted container ID achieves full command injection. Rated CVSS 9.9 with no public exploit identified at time of analysis; EPSS is very low (0.07%) and it is not on CISA KEV.
Command injection in Termix (a self-hosted web-based SSH/server-management platform) before version 2.1.0 lets attackers execute arbitrary OS commands on managed remote SSH hosts. The extractArchive and compressFiles endpoints in file-manager.ts build shell commands using double-quoted strings, which — unlike the single-quote escaping used everywhere else in the file manager — permit $(command) substitution in attacker-controlled input. SSVC classifies exploitation as PoC-stage (publicly available exploit code exists), it is not in CISA KEV, and EPSS is low (0.16%, 37th percentile), indicating no observed widespread exploitation; the flaw is fixed in 2.1.0.
Authentication bypass in Termix (self-hosted SSH web management platform) before version 2.1.0 lets an attacker who knows only a victim's password bypass TOTP two-factor authentication. The /users/login endpoint issues a temporary JWT (temp_token) carrying a pendingTOTP state that should only unlock the second-factor step, but the auth middleware wrongly accepts this token on fully authenticated endpoints, collapsing 2FA into single-factor password authentication for every TOTP-enabled account. Publicly available exploit code exists (SSVC exploitation: poc), though EPSS probability is very low (0.01%, 1st percentile) and there is no evidence of active exploitation.
Stored XSS in Termix File Manager (versions 1.7.0-1.9.0) allows attackers with SSH server access to execute arbitrary JavaScript by uploading malicious SVG files that bypass content sanitization. When a Termix user previews the crafted file, the payload executes within the application context with full access to sensitive operations. Public exploit code exists and no patch is currently available.
Termix 2.4.0 through 2.5.0 permits an attacker who already holds a victim's authenticated session and knows the account password to disable TOTP two-factor authentication or regenerate (and thereby invalidate) the victim's backup codes through POST /users/totp/disable and POST /users/totp/backup-codes, degrading the account to single-factor authentication. The defect is a regression of the fix originally shipped for CVE-2026-45749: a 2.4.0 refactor made verifyTotpReauth accept a bcrypt-validated password as an interchangeable substitute for a TOTP code, so no authenticator or valid second factor is needed. Scored CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) and tracked as EUVD-2026-86120, this is a conditional security-degradation flaw rather than a high-urgency issue - the attacker cannot reach the endpoints without an active authenticated session (PR:L) and must separately know the plaintext password (driving AC:H), and the outcome is a weakened authentication posture (integrity impact only) with no confidentiality or availability impact. Vendor-released patch: 2.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Offline recovery of stored SSH secrets is possible in Termix 1.7.0 through 2.5.0 because the keys that wrap OIDC and WebAuthn users' Data Encryption Keys are derived from committed default strings rather than operator-supplied secrets. An attacker who obtains a copy of the SQLite database - through an exposed or stolen backup, filesystem access, or a separate exfiltration bug - can recompute the wrapping key from the static default value plus the public userId salt, unwrap each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases; password-authenticated users are not affected by this derivation path. Vendor-released patch: 2.5.1. No public exploit code has been identified at time of analysis, and because the attacker must already hold the database file, this is an access-gated local data-confidentiality flaw (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) rather than a network-facing issue.
Authenticated Termix users can abuse the POST /credentials/:id/deploy-to-host endpoint to reach other users' credential and host records, because the server resolves attacker-supplied credentialId and targetHostId integers without verifying ownership. On instances running 1.7.0 through 2.5.0, this yields limited information disclosure (whether a record exists and its authType) and lets an attacker cause a victim host that authenticates by key to make an outbound SSH connection attempt using the attacker's public key; encrypted passwords and private keys are never exposed, keeping impact consistent with the assessed CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit identified at time of analysis, and the vendor fixed the authorization check in version 2.5.1.
Command injection in Termix's SSH key deployment flow affects versions 1.7.0 through 2.5.0 and lets an authenticated user with high privileges execute arbitrary commands with the selected remote account's privileges by supplying a crafted public-key token that breaks out of a double-quoted grep -F shell command. The independent assessment rates confidentiality, integrity, and availability impact as high with scope changed because code runs on the target host, not merely the Termix server; no public exploit has been identified at time of analysis, and the flaw is fixed in version 2.5.1.
Termix versions 1.8.0 through 2.5.1 expose server-stats API routes that lack per-host authorization, allowing any authenticated user to read host online/offline state and lastChecked timestamps for hosts they cannot access and to clear the instance-wide SSH connection pool. Because GET /status/:id accepts an attacker-supplied numeric host identifier, a low-privileged account can enumerate host IDs (IDOR), while POST /clear-connections disrupts other users' active sessions and pooled connections. Unauthenticated requests remain blocked and no public exploit code has been identified at time of analysis; CVSS is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) and the vendor fixed the issue in 2.5.1.
Server-side request forgery in Termix 2.5.0 lets authenticated users make the Termix server issue outbound HTTP requests to arbitrary destinations, including internal services that are normally unreachable from outside the host network. An attacker with a low-privileged account can register a webhook or ntfy notification channel pointing at an internal address and then trigger it through the notification-channel test endpoint, which reaches the request-sending code in src/backend/utils/notification-sender.ts without any destination allowlisting or private-address blocking. Because webhook mode also honors attacker-chosen HTTP methods and headers, the requests are blind but not strictly read-only: an internal service that accepts the fixed notification body may still change state, though response bodies are never returned to the attacker. No public exploit code has been identified at time of analysis and the issue is fixed in version 2.5.1.
Unauthenticated attackers can retrieve stored SSH host credentials - including addresses, usernames, and passwords - from Termix deployments running version 1.5.0 and below when the platform is served behind an Nginx reverse proxy, which is the default for the official Docker image and the official Dockerfile. The proxy causes the backend's req.ip to resolve to the proxy's own address instead of the real client, so the isLocalhost check always evaluates true and the /ssh/db/host/internal endpoint is reachable without login; publicly available exploit code exists and the flaw is fixed in version 1.6.0. Exploitation is unauthenticated (CVSS 4.0 vector PR:N) and requires no user interaction, but it is deployment-topology dependent - a Termix instance not behind a reverse proxy, where req.ip reflects the true client, should not be exposed in this way. EPSS is low (0.06%, 19th percentile) and there is no CISA KEV confirmation of active exploitation at time of analysis.