CVE-2026-45748

Published: Jun 5, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue.

Affected (1)

Products: Termix: Termix

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Termix Termix	From 2.1.0 to 2.3.2

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (3)

https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/Termix-SSH/Termix/security/advisories/GHSA-xmjh-8cc2-qm49

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/Termix-SSH/Termix/security/advisories/GHSA-xmjh-8cc2-qm49

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.