CVE-2026-22804: Termix File Manager XSS Vulnerability

CVE-2026-22804 Overview

CVE-2026-22804 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Termix web-based server management platform. The vulnerability exists in the File Manager component, where the application fails to properly sanitize SVG file content before rendering it to users. This security flaw allows an attacker who has compromised a managed SSH server to plant a malicious SVG file that, when previewed by a Termix user, executes arbitrary JavaScript in the context of the application.

Critical Impact

Successful exploitation enables attackers to execute arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized actions within the Termix management interface.

Affected Products

• Termix versions 1.7.0 through 1.9.0
• Termix File Manager component (src/ui/desktop/apps/file-manager/components/FileViewer.tsx)
• Web-based server management deployments using vulnerable Termix versions

Discovery Timeline

• 2026-01-12 - CVE CVE-2026-22804 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22804

Vulnerability Analysis

This vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw specifically manifests as a stored XSS vulnerability, which is particularly dangerous because the malicious payload persists on the server and executes every time a user views the affected content.

The attack requires an initial compromise of a managed SSH server, establishing a multi-stage attack chain. Once an attacker has access to a server managed by Termix, they can place a specially crafted SVG file on that server. When a Termix administrator browses the file system and previews the malicious SVG file through the File Manager interface, the embedded JavaScript executes within their authenticated session.

The vulnerability is fixed in Termix version 1.10.0, which implements proper sanitization of SVG content before rendering.

Root Cause

The root cause of this vulnerability is insufficient input sanitization in the FileViewer.tsx component located at src/ui/desktop/apps/file-manager/components/. The File Manager component renders SVG files directly in the browser without stripping potentially malicious elements such as <script> tags, event handlers (e.g., onload, onerror), or other JavaScript-capable SVG attributes. SVG files, being XML-based, can contain embedded JavaScript that browsers will execute when the SVG is rendered as part of the DOM.

Attack Vector

The attack leverages a network-based vector with the following characteristics:

1. Initial Access: The attacker first compromises a server that is managed through the Termix platform
2. Payload Deployment: A malicious SVG file containing embedded JavaScript is placed on the compromised server
3. Victim Interaction: A Termix user navigates to the directory containing the malicious file and previews it
4. Code Execution: The unsanitized SVG renders in the user's browser, executing the embedded JavaScript

The malicious SVG file would typically contain JavaScript embedded within SVG elements. When the Termix File Manager renders this content without proper sanitization, the browser interprets and executes the JavaScript code. Common attack payloads include session token theft, keylogging, or redirecting users to phishing pages. For detailed technical information on the vulnerability and exploitation techniques, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-22804

Indicators of Compromise

• SVG files containing <script> elements or JavaScript event handlers on managed servers
• Suspicious SVG files with obfuscated content or unusual encoding patterns
• Browser network requests originating from SVG file previews to external domains
• Unexpected session token transmissions to third-party endpoints

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Monitor web application logs for unusual File Manager access patterns, particularly SVG file previews
• Deploy web application firewalls (WAF) with rules to detect XSS payloads in file content
• Use browser-based security extensions to detect and alert on suspicious script execution

Monitoring Recommendations

• Enable verbose logging for File Manager component access and file preview operations
• Monitor for creation of new SVG files on managed servers, especially in commonly accessed directories
• Set up alerts for JavaScript errors or CSP violations originating from the Termix application
• Review access logs for unusual file browsing patterns that may indicate reconnaissance

How to Mitigate CVE-2026-22804

Immediate Actions Required

• Upgrade Termix to version 1.10.0 or later immediately
• Audit managed servers for suspicious SVG files, particularly those with embedded script content
• Review access logs to identify if any users may have viewed malicious files
• Implement Content Security Policy headers to mitigate potential exploitation

Patch Information

The vulnerability is addressed in Termix version 1.10.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper sanitization of SVG file content before rendering in the File Manager component. For additional details, see the GitHub Security Advisory.

Workarounds

• Disable SVG file previews in the File Manager until the patch can be applied
• Implement server-side SVG sanitization using libraries that strip JavaScript from SVG content
• Restrict File Manager access to trusted administrators only
• Deploy a reverse proxy with content inspection to strip malicious SVG elements

# Configuration example
# Add Content Security Policy headers to mitigate XSS attacks
# For nginx reverse proxy in front of Termix:
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;

# For Apache:
# Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';"