CVE-2026-45746: Termix Vulnerable to Arbitrary Command Execution via Session Hijacking

Synopsis

Broken access control in Termix, a web-based server management platform, allows an authenticated attacker to hijack another user's active File Manager session by manipulating a client-controlled sessionId parameter that the backend fails to validate against the requesting user's identity. The vulnerability is reachable over the network with a low-privilege account, but requires the victim to have an active session open. Successful exploitation gives the attacker full read, write, upload, and command execution access on the victim's connected remote VPS. A patched-image rebuild at version 2.3.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Termix web service over the network; the attack vector is network-exposed (AV:N).

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to the Termix platform before manipulating the sessionId parameter (PR:L).

• Victim interactionRequired

  The targeted user must have an active File Manager session open at the time of the attack, making victim interaction a prerequisite (UI:R).

• Attack complexityDetail

  Exploit conditions are straightforward and reliable with no race conditions or special environmental dependencies required (AC:L).

Blast Radius

• Attacker reads arbitrary files from the victim's remote VPS filesystem, including credentials, private keys, and application secrets.
• Attacker writes or overwrites files on the victim's VPS, enabling persistent backdoors or configuration tampering.
• Attacker executes arbitrary commands on the victim's VPS through the hijacked SSH-backed File Manager session, achieving full remote code execution.
• Confidentiality, integrity, and availability of the victim's VPS environment are all fully compromised (C:H, I:H, A:H) with scope extending beyond the Termix application itself (S:C).