CVE-2026-53542: Termix Web Platform RCE Vulnerability

CVE-2026-53542 Overview

CVE-2026-53542 is a command injection vulnerability in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The flaw resides in the archive creation endpoint located at src/backend/ssh/file-manager.ts. The endpoint passes selected file basenames to tar without an end-of-options marker and without making operands unambiguously relative. An authenticated user with access to an SSH file-manager session can craft basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec to achieve arbitrary command execution on the managed SSH host. The issue is fixed in version 2.3.2 and is classified under [CWE-78] (OS Command Injection).

Critical Impact
Authenticated attackers can execute arbitrary commands on managed SSH hosts with the privileges of the connected SSH account, leading to file disclosure, modification, and service disruption.

Affected Products

Termix versions prior to 2.3.2
Termix SSH file-manager component (src/backend/ssh/file-manager.ts)
Archive creation endpoints producing tar, tar.gz, tar.bz2, and tar.xz outputs

Discovery Timeline

2026-08-19 - CVE-2026-53542 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-53542

Vulnerability Analysis

The vulnerability stems from unsafe invocation of the GNU tar binary during archive creation. When a user selects files for archiving, Termix forwards their basenames directly to tar as command-line operands. GNU tar interprets any argument starting with -- as an option unless the caller uses the -- end-of-options marker or prefixes operands with ./ to make them unambiguously relative.

Attackers can create or select files whose names begin with GNU tar options. The --checkpoint=1 and --checkpoint-action=exec=<command> options together instruct tar to execute an arbitrary shell command after processing the first record. The resulting command runs on the remote SSH host with the privileges of the SSH account bound to the current file-manager session.

Root Cause

The root cause is missing argument sanitization in the archive creation logic. The code neither inserts -- before the operand list nor rewrites basenames to a ./name form. This allows filenames crafted by a user to be reinterpreted as tar command-line switches.

Attack Vector

An authenticated user with an active SSH file-manager session creates or uploads files whose basenames match GNU tar option syntax. The user then triggers the archive creation endpoint against those files. The backend passes the malicious basenames to tar, which invokes the checkpoint action and executes attacker-supplied commands on the SSH target.

text

// Patch reference: v2.3.2 repository hygiene changes accompanying the security fix
 lerna-debug.log*

 node_modules
+src/mcp-server/node_modules
 dist
 dist-ssr
+coverage
 *.local

 .vscode/

Source: GitHub Commit 52f4e51

Refer to the GitHub Security Advisory GHSA-rwj6-6vh7-45pv for the full remediation details including the -- and relative-path handling changes.

Detection Methods for CVE-2026-53542

Indicators of Compromise

Files present on SSH-managed hosts with basenames beginning with --checkpoint, --to-command, --use-compress-program, or other GNU tar option prefixes.
Unexpected child processes spawned by tar on managed SSH hosts, particularly shells or interpreters launched during archive operations.
Termix archive-creation requests followed shortly by outbound network connections or file modifications from the SSH account.

Detection Strategies

Audit Termix application logs for archive creation calls that include filenames beginning with -- characters.
Monitor process lineage on managed SSH hosts for tar processes forking non-archival binaries such as /bin/sh, bash, curl, or wget.
Correlate SSH session activity with unexpected command execution timestamps sourced from the Termix service account.

Monitoring Recommendations

Enable command-line auditing (auditdexecve rules) on SSH hosts managed by Termix and alert on tar invocations with --checkpoint-action arguments.
Track file creation events matching regex ^--[a-z] inside directories accessible to Termix sessions.
Forward Termix backend logs to a central SIEM and build detections around archive endpoint requests coupled with anomalous downstream host activity.

How to Mitigate CVE-2026-53542

Immediate Actions Required

Upgrade Termix to version 2.3.2 or later, which is the vendor-supplied fix.
Restrict access to the Termix file-manager to trusted administrators until the upgrade is completed.
Audit all managed SSH hosts for files whose basenames begin with -- and remove or rename any suspicious entries.

Patch Information

The issue is remediated in Termix release 2.3.2. The fix is delivered through Termix Pull Request #874 and merged in commit 52f4e51. The tagged release is available at Termix Release 2.3.2. Administrators should validate the deployment version after upgrading and restart the backend service.

Workarounds

Disable the archive creation feature by removing or gating the endpoint at a reverse proxy until the patch is applied.
Enforce strict SSH account permissions so that the Termix-connected account has minimal privileges on managed hosts, reducing blast radius.
Prevent creation of files with names beginning with -- inside directories exposed to Termix sessions by applying filesystem-level naming policies.

bash

# Upgrade Termix to the patched release
docker pull ghcr.io/termix-ssh/termix:release-2.3.2-tag
docker stop termix && docker rm termix
docker run -d --name termix ghcr.io/termix-ssh/termix:release-2.3.2-tag

# Audit managed SSH hosts for suspicious filenames
find / -maxdepth 6 -name '--*' -print 2>/dev/null