CVE-2026-45744

Katalog CVE

CVSS 9.9 · Critical EPSS 3,0%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada termix. Skor CVSS 3.1 9.9 (Critical) menurut github.com.

Deskripsi (NVD)

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

Rincian

Terbit di NVD

5 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 86,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-37f4-wq95-pg33 exploit · mitigasi · advisory vendor
• https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag product · release notes