Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2026-42453: Termix files feature lets attackers run commands
CVE-2026-42453 · published 6 months ago
Summary
Versions of Termix earlier than 2.1.0 allow the archive‑extract and file‑compress functions to be tricked into running extra commands on the server. This could let an attacker cause the server to do things you didn’t intend. Upgrade to Termix 2.1.0 or later to fix the issue.
Original advisory text
Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.
References
- https://github.com/Termix-SSH/Termix/releases/tag/release-2.1.0-tag URL
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-rvg4-7vvq-9c2w Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42453... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42453 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-77Command Injection
Timeline
Published8 May 2026
Updated31 Oct 2026
First seen8 May 2026
Track software like this
Free during beta