CVE-2026-120322
Received Received - Intake

Path Traversal in Termix-SSH Termix

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120322

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Termix-SSH Termix 2.9.0
Termix-SSH Termix 2.9.1
Termix-SSH Termix 2.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120322 is a path traversal vulnerability in Termix-SSH Termix up to version 2.9.2. It affects the file /plugin-api/file-manager/transferToHost where the destPath argument is manipulated to write files to unintended locations on the server. The attack can be performed remotely by an authenticated user.

Detection Guidance

Check Termix logs for unusual file transfer requests to sensitive paths like /app/data/.env or plugin directories. Monitor network traffic for SOCKS5 proxy connections from Termix clients. Inspect file-manager plugin versions; vulnerable versions are 2.9.2 and earlier.

Impact Analysis

This vulnerability allows an attacker to write arbitrary files to any location on the Termix server filesystem. This could lead to full instance takeover by overwriting plugin archives or modifying environment files to control secrets like JWT keys. Exploitation requires only an ordinary Termix account and an attacker-controlled SSH server with SOCKS5 proxy support.

Mitigation Strategies

Upgrade Termix to v26.10.0 or later and ensure the File Manager plugin is v1.0.0 or later. Restrict file transfer destinations to pre-registered hosts only. Disable SOCKS5 proxy support in SSH configurations if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120322. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...