CVE-2026-42453CWE-77

Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass

High · published May 8, 2026

CVSS v4.0
8.7
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.01554 · 75.0th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-05-08T22:55Z
EPSS history
Timeline
  • 08 MAY 22:55Z
    Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass
    cvelistv5