CVE-2026-45746 Termix Vulnerable to Arbitrary Command Execution via Session Hijacking
Attackers can hijack File Manager sessions to execute arbitrary commands on other users' remote servers due to improper session validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45746?
CVE-2026-45746 is a critical missing authorization vulnerability in Termix-SSH Termix, published on 5 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.
Which versions are affected by CVE-2026-45746?
It affects 1 product.
Products include Termix Termix.
How do I fix CVE-2026-45746?
No fix has been published for CVE-2026-45746 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45746 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45746 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Termix-SSH Termix
- CVE-2026-45744 Termix has an OS Command Injection in File Manager resolvePath endpoint
- CVE-2026-45748 Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection
- CVE-2025-59951 Termix' official Docker image contains an authentication bypass vulnerability
- CVE-2026-45750 Termix Vulnerable to Arbitrary Command Execution in File Manager
- CVE-2026-45743 Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR)
Sources
Also known as GHSA-cx2r-843c-vww8.