CVE-2026-45744 Termix has an OS Command Injection in File Manager resolvePath endpoint

Critical 9.9 Published 5 Jun 2026 Updated 10 Jun 2026

Authenticated users can execute arbitrary OS commands on remote hosts via the File Manager resolvePath endpoint due to improper shell escaping.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-45744?

CVE-2026-45744 is a critical command injection vulnerability in Termix-SSH Termix, published on 5 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

Weakness: CWE-78

Which versions are affected by CVE-2026-45744?

It affects 1 product.

Products include Termix Termix.

How do I fix CVE-2026-45744?

No fix has been published for CVE-2026-45744 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-45744 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45744 exists.

Sources

Also known as GHSA-37f4-wq95-pg33.