CVE-2026-120322 Termix-SSH CVE debrief

Who should care

Defenders responsible for Termix-SSH Termix deployments should assess exposure and apply patches or mitigations to prevent potential exploitation. This includes verifying the version of Termix-SSH Termix, monitoring for potential exploitation attempts, and implementing compensating controls. Security teams and vulnerability management teams should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor.

Why it matters

The publicly available exploit for this high-severity path traversal vulnerability in Termix-SSH Termix up to 2.9.2 requires defenders to verify exposure and apply patches or mitigations to prevent potential exploitation.

• Verify exposure and apply patches or mitigations to prevent potential exploitation
• Monitor for potential exploitation attempts
• Implement compensating controls, such as restricting access to the affected file

Technical summary

The vulnerability affects the file /plugin-api/file-manager/transferToHost in Termix-SSH Termix up to 2.9.2, allowing for path traversal attacks. The exploit is publicly available, and the issue was addressed in the standalone File Manager plugin v1.0.0 and core v26.10.0. The vulnerability has a high CVSS score of 8.6, indicating a significant risk to affected deployments. Defenders should prioritize verifying exposure and applying patches or mitigations. The CVE record and NVD entry provide limited information about the vulnerability, and the vendor did not respond to early disclosure.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, as the exploit is publicly available and the vulnerability has a high CVSS score of 8.6.

Recommended defensive actions

• Verify exposure by checking the version of Termix-SSH Termix and applying patches or mitigations if necessary
• Monitor for potential exploitation attempts
• Implement compensating controls, such as restricting access to the affected file
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, and the vendor did not respond to early disclosure. The exploit is publicly available, but there is no information on its use in attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.