CVE-2026-53545 in Termix
Summary
by MITRE • 08/20/2026
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
Termix operates as a web-based server management platform providing essential infrastructure tools such as an SSH terminal, network tunneling services, and remote file editing capabilities. The security flaw identified within versions prior to 2.3.2 resides specifically in the backend handling of SSH tunnel teardown operations. When a user initiates the disconnection of an active SSH tunnel via the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint, the application constructs system commands to terminate associated processes. This process involves interpolating several variables derived from the tunnel configuration, including the endpoint port, source port, endpoint username, and endpoint IP address, into a shell command string formatted for execution by pkill with a filter pattern enclosed in single quotes.
The core technical vulnerability is a classic Command Injection flaw resulting from insufficient input sanitization and improper use of quoting mechanisms. Specifically, the application constructs the argument passed to the operating system's process killer utility using simple string interpolation without validating or escaping special shell characters within the user-supplied fields. Because the interpolated values are wrapped in single quotes for the pkill filter pattern, an authenticated attacker who possesses the ability to edit tunnel host configurations can inject a closing single quote into any of these fields. This injection effectively terminates the intended command argument early and allows the attacker to append arbitrary shell commands that will be executed by the underlying operating system when the disconnect action is triggered.
The operational impact of this vulnerability is severe, as it leads to Remote Code Execution with the privileges of the SSH account currently connected through Termix. An authenticated user can exploit this flaw not only on their own sessions but potentially against other users if they have access to manage tunnels for those accounts or if session sharing mechanisms are in place. By crafting a malicious tunnel configuration where one of the interpolated fields contains a payload such as ' ; rm -rf / ; ', the attacker forces the server to execute destructive commands upon disconnection. This bypasses standard web application security controls because the execution occurs at the system shell level, leveraging the trust relationship between Termix and the SSH host it manages.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The attack vector is classified under MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically involving shell commands executed via a web application interface. The exploitation requires authentication, placing it within the context of authenticated attacks where privilege escalation or lateral movement may follow successful initial access.
To mitigate this vulnerability, organizations must immediately upgrade Termix to version 2.3.2 or later, which addresses the input validation and command construction logic. In environments where upgrading is not immediately feasible, strict input filtering should be implemented on all fields that are interpolated into system commands, ensuring that shell metacharacters such as single quotes, double quotes, semicolons, and pipe characters are either rejected or properly escaped using language-specific safe APIs rather than manual string concatenation. Additionally, applying the principle of least privilege to the user account running the Termix backend service can limit the blast radius of any successful exploitation attempt by restricting access to critical system directories and commands.