CVE-2026-45750Disclosure(termix / termix)

LOWCVSS 9.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch termix termix systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.

termix CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag

Weakness type (CWE)

CWE-78CWE-639

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

termix

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 1d ago at 3 mentions (2026-06-06); latest day: 1
5 total mentions across 3 days

Affected systems

Vendors

termix

Products

termix

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Disclosure

240.0%

General

240.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	1	Disclosure1
2026-06-06	3	Disclosure1General2
2026-06-08	1	Patch1

Full discourse5 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters134d
Patch
CVE-2026-45750 - Critical OS Command Injection in Termix. Unpatched. CVSS 9.0. Exploitable via file manager path parameter. Upgrade to 2.3.2 or restrict access immediately. #CVE #infosec #Termix #CVEAlert FREE Information available: https://www.valtersit.com/cve/CVE-2026-45750/
Post summary
A critical OS Command Injection vulnerability (CVE-2026-45750) in Termix is unpatched, rated CVSS 9.0, and can be mitigated by upgrading to version 2.3.2 or restricting access.
0000057
921 followersView on X
ThreatCluster@threatcluster136d
Disclosure
Termix server management platform versions before 2.3.2 have RCE flaws CVE-2026-45748 and CVE-2026-45750 in POST /ssh/tunnel/connect and GET /ssh/file_manager/ssh/resolvePath, allowing OS command injection, CVE records show. https://threatcluster.io/cluster/multiple-cves-discovered-in-termix-server-management-platfor-b8cd4a92
Post summary
The post discloses RCE vulnerabilities in Termix server management platform versions before 2.3.2, detailing the affected endpoints and injection vectors, but does not provide any PoC, exploit code, patch information, or evidence of active exploitation.
00000104
313 followersView on X
Infoflowcloud@infoflowcloud136d
General
🚨*CVE* CVE-2026-45750 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/re… https://www.cve.org/CVERecord?id=CVE-2026-45750 ----- Traducción: CVE-2026-45750 Ter… http://infoflow.cloud`
Post summary
The post announces CVE-2026-45750 and links to its cve.org record, but provides no evidence of exploitation, detailed vulnerability data, or mitigation information.
0000031
79 followersView on X
CVE@CVEnew136d
General
CVE-2026-45750 Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/re… https://www.cve.org/CVERecord?id=CVE-2026-45750
Post summary
The post briefly references CVE-2026-45750 affecting Termix prior to version 2.3.2, but lacks actionable details, exploitation evidence, or mitigation guidance.
00000223
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-45750 Command Injection in Termix File Manager Prior to Version 2.3.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45750
Post summary
A newly disclosed command injection vulnerability (CVE-2026-45750) affects Termix File Manager prior to v2.3.2, with no evidence of exploitation or patches reported.
0000047
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	termix	termix	-	-	-

Explore more

Back to dashboard termix CVEs termix vulnerabilities

What researchers are saying

CVE-2026-45750

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

A critical OS Command Injection vulnerability (CVE-2026-45750) in Termix is unpatched, rated CVSS 9.0, and can be mitigated by upgrading to version 2.3.2 or restricting access.

ThreatCluster[verified]@threatclusterDisclosure

The post discloses RCE vulnerabilities in Termix server management platform versions before 2.3.2, detailing the affected endpoints and injection vectors, but does not provide any PoC, exploit code, patch information, or evidence of active exploitation.

Infoflowcloud@infoflowcloudGeneral

The post announces CVE-2026-45750 and links to its cve.org record, but provides no evidence of exploitation, detailed vulnerability data, or mitigation information.

CVE@CVEnewGeneral

The post briefly references CVE-2026-45750 affecting Termix prior to version 2.3.2, but lacks actionable details, exploitation evidence, or mitigation guidance.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A newly disclosed command injection vulnerability (CVE-2026-45750) affects Termix File Manager prior to v2.3.2, with no evidence of exploitation or patches reported.