CVE-2026-53542

Termix, a web-based server management platform, versions 1.7.0 to 1.9.0, has a Stored Cross-Site Scripting (XSS) vulnerability in the File Manager component. The application fails to sanitize SVG file content before rendering, allowing an attacker who has compromised a managed SSH server to plant a malicious file. When previewed by the Termix user, it executes arbitrary JavaScript in the application context. This is fixed in version 1.10.0.

In Termix from 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.

Termix before version 2.6.1 contains a vulnerability in the GET /host/db/host/:id/password endpoint that does not enforce host ownership during credential resolution. An authenticated user can enumerate host IDs and retrieve SSH or sudo passwords belonging to other users.

Termix before version 2.3.2 contains a vulnerability in the terminal WebSocket that allows an authenticated low-privileged user to use another user's credentials to connect to an attacker-controlled SSH server. This can lead to disclosure of SSH passwords or private keys.

Termix before version 2.3.2 contains a vulnerability in the SSH tunnel teardown path that interpolates user-controlled data into a pkill command pattern. An authenticated user can inject a shell command that executes when the tunnel is disconnected.

Termix is a web-based server management platform that prior to version 2.3.2 had a vulnerability in the `POST /ssh/tunnel/connect` endpoint. This vulnerability allowed OS command injection through user-controlled fields being interpolated directly into a shell command.

Termix is a web-based server management platform that was vulnerable to OS command injection in the GET /ssh/file_manager/ssh/resolvePath endpoint prior to version 2.3.2. This allows authenticated users to execute arbitrary commands on the connected remote host.

Termix prior to version 2.1.0 contains a command injection vulnerability in Docker container management endpoints, where the containerId parameter is directly interpolated into shell commands, allowing an authenticated attacker to achieve remote code execution on the managed server.

Termix versions 1.5.0 and below, when using the official Docker image or an Nginx reverse proxy, incorrectly identifies the client IP as the proxy IP, causing isLocalhost to always return True. This makes the /ssh/db/host/internal endpoint accessible without login or authentication, exposing stored SSH host information including addresses, usernames, and passwords.

Termix versions 2.5.0 through 2.5.1 have a vulnerability in the /homepage/proxy endpoint that passes the url parameter to http.get or https.get without destination restrictions. URL validation is only syntactic, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. An authenticated low-privilege user can exfiltrate internal service data and cloud credentials.