Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.
Fix
Public exploits 1
- GabrielHA12/Termix-research PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8 Exploit, Mitigation, Vendor Advisory
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8 Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.0 · termixNVD modified 2026-10-26 11:10
Affected (CPE criteria) 1
cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*
References 2
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8 Exploit, Mitigation, Vendor Advisory
- https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8 Exploit, Mitigation, Vendor Advisory