PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45748 Termix-SSH CVE debrief

CVE-2026-45748 is a critical OS command injection vulnerability in Termix, a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. This vulnerability has a CVSS score of 9.8 and is considered CRITICAL.

Vendor
Termix-SSH
Product
Termix
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-05
Original CVE updated
2026-06-08
Advisory published
2026-06-05
Advisory updated
2026-06-08

Who should care

Users of Termix versions prior to 2.3.2 should apply the patch to prevent exploitation of this vulnerability.

Technical summary

The vulnerability exists in the `POST /ssh/tunnel/connect` endpoint of Termix. User-controlled input is directly interpolated into a shell command without proper escaping, allowing an attacker to inject OS commands.

Defensive priority

High

Recommended defensive actions

  • Upgrade to Termix version 2.3.2 or later.
  • Review and restrict access to the `POST /ssh/tunnel/connect` endpoint.
  • Implement additional security measures to monitor and detect potential exploitation attempts.

Evidence notes

The CVE record and NVD detail provide evidence of the vulnerability and its impact.

Official resources

CVE-2026-45748 was published on 2026-06-05T18:17:31.000Z and modified on 2026-06-08T17:16:44.697Z.