CVE-2026-79766: Termix Web Platform RCE Vulnerability

CVE-2026-79766 Overview

CVE-2026-79766 is an OS command injection vulnerability [CWE-78] in Termix, a web-based server management platform providing SSH terminal, tunneling, and file editing capabilities. The flaw affects versions 2.4.1 through 2.5.0 and allows an authenticated administrator to execute arbitrary operating-system commands as the Termix backend process. Attacker-controlled domain and email values submitted through PATCH /users/acme-ssl-settings are interpolated into a certbot shell command invoked by child_process.execSync. Both HTTP webroot and DNS Cloudflare challenge modes are affected. The issue is fixed in version 2.5.1.

Critical Impact
Successful exploitation grants arbitrary command execution as the Termix backend process, exposing databases, process secrets, stored SSH credentials, and reachable internal networks.

Affected Products

Termix 2.4.1 through 2.5.0
src/backend/database/routes/acme-ssl-routes.ts component
ACME SSL settings and request endpoints (HTTP webroot and DNS Cloudflare modes)

Discovery Timeline

2026-09-24 - CVE-2026-79766 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-79766

Vulnerability Analysis

Termix exposes two administrator endpoints for managing automated SSL certificate issuance via certbot. The PATCH /users/acme-ssl-settings endpoint accepts and persists a domain name and contact email. The POST /users/acme-ssl-request endpoint later reads those stored values and builds a shell command string that invokes certbot through /bin/sh -c.

The backend wraps the user-controlled values in double quotes before passing the string to child_process.execSync. Double-quote wrapping does not neutralize shell metacharacters such as `, $(), ;, &&, or |. An authenticated administrator can therefore inject shell syntax inside the domain or email field and have it executed by the shell as the Termix backend user.

Both challenge modes are vulnerable, meaning deployments using either HTTP webroot validation or Cloudflare DNS validation can be abused. The compromise scope includes the Termix database, environment-based process secrets, stored SSH credentials for managed hosts, and network paths reachable from the backend host.

Root Cause

The root cause is the use of execSync with string concatenation of untrusted input, instead of execFileSync with an argument array. The upstream fix in commit c7a9063 replaces the vulnerable call site accordingly.

Attack Vector

An attacker with a valid Termix administrator session sends a PATCH /users/acme-ssl-settings request containing a crafted domain or email value that embeds shell metacharacters. A subsequent POST /users/acme-ssl-request triggers the stored payload inside the /bin/sh -c invocation, running attacker-chosen commands under the Termix backend process.

typescript

// Patch: switch from execSync to execFileSync to avoid shell interpretation
-import { execSync } from "child_process";
+import { execFileSync } from "child_process";
 import { promises as fs } from "fs";
 import path from "path";
 import type { AuthenticatedRequest } from "../../../types/index.js";

Source: GitHub Commit c7a9063

Detection Methods for CVE-2026-79766

Indicators of Compromise

Unexpected child processes spawned by the Termix Node.js backend, especially shells (/bin/sh, /bin/bash) or network utilities (curl, wget, nc).
ACME settings records containing shell metacharacters such as `, $(, ;, &&, or | in domain or email fields.
certbot invocations in process accounting logs that include unexpected arguments or command separators.
Outbound connections from the Termix host to unknown destinations shortly after an acme-ssl-request call.

Detection Strategies

Audit the Termix application database for stored ACME settings values containing non-DNS or non-email characters.
Review HTTP access logs for PATCH /users/acme-ssl-settings and POST /users/acme-ssl-request sequences from administrator sessions.
Correlate ACME request events with process-execution telemetry showing child processes other than certbot itself.

Monitoring Recommendations

Enable process-creation logging on the Termix host and alert on shell invocations parented by the Node.js runtime.
Monitor file integrity on the Termix backend, including SSH key material and SQLite or database files.
Track administrator authentication events and flag privilege changes or new administrator accounts preceding ACME configuration edits.

How to Mitigate CVE-2026-79766

Immediate Actions Required

Upgrade Termix to version 2.5.1 or later, which replaces execSync with execFileSync in the ACME SSL routes.
Rotate all SSH credentials, API tokens, and Cloudflare DNS API keys stored in or reachable from the Termix backend.
Review administrator account inventory and revoke sessions for any accounts that are not strictly required.
Inspect the Termix host for persistence artifacts, including cron entries, new system users, and modified startup scripts.

Patch Information

The fix is included in Termix release 2.5.1, delivered through Pull Request #1067 and documented in GitHub Security Advisory GHSA-pr55-25gf-5f9v. The code change in commit c7a9063 switches the vulnerable call to execFileSync, which passes arguments directly to the executable without shell interpretation.

Workarounds

Restrict network reachability to the Termix administrative interface using a reverse proxy or firewall allowlist until the patch is applied.
Disable the ACME SSL automation feature if automated certificate issuance is not required in your deployment.
Enforce strong authentication and multi-factor authentication for all Termix administrator accounts to limit the pool of actors who can reach the vulnerable endpoints.

bash

# Upgrade Termix container deployment to the patched release
docker pull ghcr.io/termix-ssh/termix:release-2.5.1-tag
docker stop termix && docker rm termix
docker run -d --name termix \
  -p 8080:8080 \
  -v termix-data:/app/data \
  ghcr.io/termix-ssh/termix:release-2.5.1-tag