CVE-2026-79764
Received Received - Intake

Path Traversal and SSRF in Termix Web Management Platform

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. The endpoint returns the complete fetched JSON response, so a low-privilege or self-registered account can exfiltrate internal service data and cloud credentials. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-79764
EUVD
EUVD-2026-86199

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
termix termix to 2.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Termix (versions 2.5.0 to 2.5.1) allows authenticated users to send HTTP requests to arbitrary internal or external destinations via the /homepage/proxy endpoint. The endpoint accepts a URL parameter and forwards requests without restrictions, enabling access to loopback addresses, private networks, and cloud metadata services. The response includes full JSON data, allowing attackers to exfiltrate sensitive information like internal service data or cloud credentials.

Detection Guidance

Check Termix logs for unusual outbound requests from the /homepage/proxy endpoint. Monitor network traffic for connections to internal IPs, RFC1918 ranges, or cloud metadata endpoints initiated by Termix processes.

Impact Analysis

If you use Termix versions 2.5.0 or 2.5.1, an attacker with low-privilege or self-registered access could exploit this to steal internal service data, cloud credentials, or other sensitive information. This could lead to data breaches, unauthorized access to systems, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive data. Organizations using affected Termix versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Termix to version 2.5.1 or later immediately. If upgrading is not possible, restrict access to the /homepage/proxy endpoint or disable it entirely until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79764. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart