CVE-2026-42453: Termix Platform RCE Vulnerability

CVE-2026-42453 Overview

CVE-2026-42453 is a command injection vulnerability in Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing capabilities. The flaw exists in the extractArchive and compressFiles endpoints of file-manager.ts in versions prior to 2.1.0. These endpoints construct shell commands using double-quoted strings, while all other file manager operations rely on single-quote escaping. Double quotes permit $(command) substitution, allowing an attacker to inject arbitrary commands that execute on the remote SSH host. The issue is categorized under CWE-77 and is fixed in Termix 2.1.0.

Critical Impact

Attackers can execute arbitrary shell commands on the remote SSH host through crafted archive or compression requests, compromising the integrity of managed servers.

Affected Products

• Termix versions prior to 2.1.0
• file-manager.tsextractArchive endpoint
• file-manager.tscompressFiles endpoint

Discovery Timeline

• 2026-05-08 - CVE-2026-42453 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-42453

Vulnerability Analysis

The vulnerability resides in two file manager endpoints that build SSH shell commands from user-supplied parameters. The extractArchive and compressFiles handlers wrap input values in double quotes when assembling the command string sent to the remote host. In POSIX shells, double-quoted strings preserve the special meaning of the $ character, so any payload containing $(...) is evaluated as a subshell before the outer command runs.

Other file manager operations in the same codebase correctly use single-quote escaping. Single quotes disable all shell metacharacter interpretation, which neutralizes command substitution. The inconsistency between the safe and unsafe code paths is the core defect.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-77]. The developer-selected quoting style for the two affected endpoints fails to escape $, backticks, and ${} constructs. User-controlled filenames, paths, or archive names flow directly into the shell without sanitization, enabling arbitrary command execution.

Attack Vector

An unauthenticated network attacker can reach the vulnerable endpoints over HTTP and submit a request containing a filename or archive parameter with an embedded $(payload) expression. When Termix forwards the constructed command to the connected SSH host, the host shell expands the substitution and executes the attacker's commands with the privileges of the SSH session user. No user interaction is required.

The vulnerability is described in prose because no verified proof-of-concept is published. See the GitHub Security Advisory for additional technical context.

Detection Methods for CVE-2026-42453

Indicators of Compromise

• HTTP requests to Termix endpoints containing $(, backticks, or ${ characters in filename, path, or archive parameters.
• Unexpected child processes spawned by the SSH session user on managed remote hosts following archive extraction or compression activity.
• Outbound network connections from managed SSH hosts to unfamiliar destinations shortly after Termix file manager API calls.

Detection Strategies

• Inspect web server and reverse-proxy logs for requests to extractArchive and compressFiles routes carrying shell metacharacters in parameter values.
• Correlate Termix application logs with SSH host process auditing (auditd, sysmon for Linux) to flag command executions that do not match expected tar, zip, or unzip invocations.
• Deploy runtime detection on managed servers to identify command substitution patterns originating from SSH-spawned shells.

Monitoring Recommendations

• Enable verbose request logging on the Termix front end and forward logs to a centralized analytics platform for retention and search.
• Monitor the version banner of all Termix deployments and alert on any instance reporting a release earlier than 2.1.0.
• Track process ancestry on remote hosts so that any non-archive command launched as a child of an SSH session triggers an alert.

How to Mitigate CVE-2026-42453

Immediate Actions Required

• Upgrade every Termix instance to version 2.1.0 or later without delay.
• Restrict network access to the Termix management interface using firewall rules or a VPN until patching is complete.
• Audit recent file manager activity for evidence of exploitation, focusing on extractArchive and compressFiles calls.

Patch Information

The maintainers fixed the vulnerability in Termix 2.1.0 by aligning the extractArchive and compressFiles endpoints with the single-quote escaping used elsewhere in file-manager.ts. Refer to the GitHub Release Notes for 2.1.0 for the full set of changes and the GitHub Security Advisory GHSA-rvg4-7vvq-9c2w for advisory details.

Workarounds

• If immediate upgrade is not possible, disable the file manager feature or block access to the archive and compression routes at the reverse proxy.
• Limit the privileges of the SSH account used by Termix on managed hosts to reduce the impact of successful injection.
• Require authentication and IP allow-listing in front of the Termix application to shrink the attack surface.

# Example reverse-proxy rule to block requests with shell metacharacters
location ~* /(extractArchive|compressFiles) {
    if ($args ~* "\$\(|\`|\$\{") { return 403; }
    proxy_pass http://termix_backend;
}