CVE-2026-45750: Termix Vulnerable to Arbitrary Command Execution in File Manager

Synopsis

This is a command injection vulnerability in Termix, a web-based server management platform. The File Manager component's resolvePath endpoint embeds a user-supplied path parameter directly into a shell command executed over an active SSH session; because only double quotes are escaped, an attacker can inject shell command substitution syntax (such as $(...)) to run arbitrary commands on the remote server. Exploitation requires network access and a low-privilege authenticated session, but no fix version has been published yet. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Termix web service via HTTP/HTTPS.

• AuthenticationRequired

  Any low-privilege authenticated account in Termix is sufficient to reach the vulnerable endpoint and inject commands.

• Victim interactionRequired

  A victim user must interact with the application (for example, open a crafted link or navigate to a manipulated path) for the injected command to execute in the context of their active SSH session.

• Attack complexityDetail

  Attack complexity is low, meaning the injection is straightforward and reliable with no race conditions or special environmental prerequisites required.

Blast Radius

• A successful attacker executes arbitrary shell commands on the remote server that Termix manages over SSH, with the privileges of the SSH session user.
• Confidential data on the remote server, including credentials, configuration files, and application data, is readable by the attacker.
• The attacker can write, modify, or delete files and database records on the remote server.
• The attacker can crash running services or render the remote server unavailable by terminating processes or consuming resources.