Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-19T21:16:56.557Z",
  "pubdate": "2026-08-19T21:16:56.557Z",
  "executiveSummary": "A command injection vulnerability exists in Termix prior to version 2.3.2.\nThe vulnerability affects the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path within the application.\nAuthenticated users capable of editing tunnel host fields can exploit this flaw to execute arbitrary commands.\nSuccessful exploitation results in arbitrary command execution on the source SSH host under the privileges of the connected SSH account.\nThe root cause stems from improper input sanitization and unsafe string interpolation into operating system command patterns.\nRisk implications include full compromise of the underlying SSH host environment depending on user account privileges.\nExploitation requires authentication and the ability to modify tunnel host parameters within the management platform.",
  "technicalDetails": "The vulnerability resides in the src/backend/ssh/tunnel.ts file of the Termix server management platform.\nSpecifically, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path unsafely interpolates user-controlled variables including endpointPort, sourcePort, endpointUsername, and endpointIP directly into single-quoted pkill -f patterns.\nBecause the input is enclosed in single quotes without proper escaping or sanitization, an authenticated attacker can supply a malicious payload containing a single quote character.\nThis single quote terminates the intended pkill pattern prematurely, allowing the attacker to append arbitrary shell commands.\nThe attack flow proceeds as follows: 1) An authenticated user with permissions to edit tunnel configurations modifies a tunnel host field to include a payload with a closing single quote and concatenated shell commands. 2) The user initiates the teardown process via the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint. 3) The backend constructs the pkill -f command string using the unescaped interpolated parameters. 4) The operating system executes the resulting command string, parsing the injected shell commands alongside or instead of the intended process termination pattern.\nThe affected versions include all Termix deployments prior to version 2.3.2.\nAuthentication is required to access the interface and manipulate tunnel configurations.\nPrivilege requirements include the ability to edit tunnel host fields and trigger tunnel disconnection.\nThe post-exploitation impact includes the execution of arbitrary commands on the source SSH host with the operational privileges of the connected SSH account."
}