Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Termix admin can run arbitrary system commands

CVE-2026-79766 · published 1 day ago
Summary

In versions 2.4.1 through 2.5.0, a logged‑in Termix administrator could enter a malicious web address or email address that the system later places into a shell command. This lets the attacker execute any operating‑system command, potentially exposing databases, credentials and other internal resources. Upgrade Termix to version 2.5.1 or later, and limit admin privileges until the update is applied.

Original advisory text
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-contro...
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.
References
Severity
9.1 Critical
CVSS 3.1: 9.1 (NVD)
Type
CWE-78OS Command Injection
Timeline
Published24 Sep 2026
Updated24 Sep 2026
First seen24 Sep 2026
Sources
CVE-2026-79766 · NVD
Track software like this
Free during beta