Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands unambiguously relative. A user with access to an SSH file-manager session can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar, tar.gz, tar.bz2, or tar.xz creation to interpret those names as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption. This issue is fixed in version 2.3.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T21:16:56.400Z",
  "pubdate": "2026-08-19T21:16:56.400Z",
  "executiveSummary": "A command injection vulnerability exists within the archive creation functionality of Termix prior to version 2.3.2. The vulnerability stems from improper handling of user-supplied file basenames passed to the underlying tar archiving utility without appropriate end-of-options delimiters or path normalization.\nAn authenticated user with access to an SSH file-manager session can supply maliciously crafted filenames beginning with GNU tar command-line options, such as --checkpoint=1 and --checkpoint-action=exec. Exploitation of this flaw allows the execution of arbitrary commands on the managed SSH host.\nThe impact includes unauthorized file disclosure, file modification, and service disruption, executed with the privileges of the connected SSH account. Remediation requires upgrading Termix to version 2.3.2 or later, which properly secures the archive creation endpoint against argument injection vectors.",
  "technicalDetails": "The vulnerability resides in the archive creation endpoint located in src/backend/ssh/file-manager.ts of the Termix web-based server management platform. The root cause is the insecure invocation of the system tar utility, where selected file basenames are passed as arguments without an end-of-options marker (--). Additionally, the operands are not sanitized to ensure they are unambiguously treated as relative paths.\nAffected versions include all Termix deployments prior to version 2.3.2. Exploitation requires an attacker to possess valid access to an SSH file-manager session within the platform, implying an authenticated context. No specific network exposure beyond the standard web interface session is required, and the exploitation executes within the security context of the connected SSH account privileges.\nThe attack flow proceeds as follows: First, the authenticated user navigates to the file-manager interface and selects or creates files whose basenames begin with specific GNU tar option flags. In this vulnerability scenario, malicious filenames such as --checkpoint=1 and --checkpoint-action=exec are utilized. When the user initiates an archive creation operation (such as tar, tar.gz, tar.bz2, or tar.xz generation), the backend script in src/backend/ssh/file-manager.ts passes these filenames directly to the tar binary without prepending an end-of-options marker.\nBecause the input is not properly delimited or sanitized, the tar utility parses the malicious basenames as command-line options rather than target archive operands. Specifically, the injection of checkpoint action parameters instructs the tar process to execute arbitrary operating system commands specified within the payload during the archiving process. The resulting payload behavior leads directly to arbitrary command execution on the managed SSH host.\nPost-exploitation impact encompasses full compromise of the managed SSH host within the boundaries of the connected user account privileges. This enables adversaries to perform unauthorized file reading and disclosure, modify system or application configurations, and trigger denial-of-service conditions or service disruptions."
}