CVE-2026-45744: Termix has an OS Command Injection in File Manager resolvePath endpoint

Synopsis

OS command injection in Termix, a web-based server management platform with SSH terminal and file management capabilities. The vulnerability is reachable over the network by any authenticated user holding a low-privilege account with an active File Manager SSH session, requiring no victim interaction. Successful exploitation gives the attacker arbitrary command execution on the remote host connected through Termix, with full control over confidentiality, integrity, and availability of that system, and with scope extending beyond the Termix process itself. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment upstream ships a release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Termix web service from a network-accessible location.

• AuthenticationRequired

  Any low-privilege Termix account with an active File Manager SSH session is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker sends a crafted request directly to the API endpoint and does not need any action from another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free - the double-quote escaping bypass using $(...) or backtick substitution requires no race conditions or special environmental factors.

Blast Radius

• Attacker executes arbitrary OS commands on the remote host connected through Termix, gaining full shell-level access to that system.
• All files, credentials, secrets, and data stored on the remote host are readable and exfiltrable by the attacker.
• The attacker can modify or delete any file on the remote host, including configuration files, application data, and stored keys.
• The remote host and any services running on it can be crashed, reconfigured, or used as a pivot point into adjacent systems, given the Changed scope of the vulnerability.