CVE-2026-53545

Received Received - Intake

Termix SSH Tunnel Command Injection Vulnerability

Publication date: 2026-08-19

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-21

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53545

EUVD

EUVD-2026-62860

Affected Vendors & Products

Vendor	Product	Version / Range
termix	termix	2.3.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in Termix, a web-based server management platform. The issue occurs in the tunnel disconnection endpoint where user-controlled input is improperly sanitized and interpolated into a shell command. An authenticated attacker can manipulate tunnel host fields to inject malicious commands via single quotes, which execute when the tunnel is disconnected. The vulnerability affects versions prior to 2.3.2.

Detection Guidance

Check Termix version with 'curl -s http://<termix-server>/api/version' or 'dpkg -l termix'. If version is below 2.3.2, the system is vulnerable. Review tunnel configurations for unusual host entries containing single quotes or shell metacharacters.

Impact Analysis

An attacker with authenticated access could execute arbitrary commands on the SSH host with the privileges of the connected SSH account. This could lead to full system compromise, data theft, or unauthorized modifications. The impact depends on the privileges of the SSH account used by Termix.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's integrity and confidentiality requirements and HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Termix to version 2.3.2 or later immediately. If immediate upgrade is not possible, restrict authenticated user access to tunnel editing features and monitor for suspicious tunnel disconnections.

Hi! I’m here to help you understand CVE-2026-53545. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70