CVE-2026-45748 Termix Vulnerable to Remote Code Execution via SSH Tunnel Forward Command Injection

What is CVE-2026-45748?

CVE-2026-45748 is a critical command injection vulnerability in Termix-SSH Termix, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue.

Weakness: CWE-78

Which versions are affected by CVE-2026-45748?

It affects 1 product.

Products include Termix Termix.

How do I fix CVE-2026-45748?

No fix has been published for CVE-2026-45748 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-45748 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45748 exists.

Other vulnerabilities in Termix-SSH Termix

• CVE-2026-45744 Termix has an OS Command Injection in File Manager resolvePath endpoint Critical 9.9
• CVE-2025-59951 Termix' official Docker image contains an authentication bypass vulnerability Critical 9.2
• CVE-2026-45746 Termix Vulnerable to Arbitrary Command Execution via Session Hijacking Critical 9.0
• CVE-2026-45750 Termix Vulnerable to Arbitrary Command Execution in File Manager Critical 9.0
• CVE-2026-45743 Termix has a File-Manager Session Hijack via Missing Ownership Check (IDOR) High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xmjh-8cc2-qm49.