CVE-2026-79761: Termix-SSH Termix

Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1.

Affected products

• Termix-SSH Termix: from 1.7.0, before 2.5.1 (fixed in 2.5.1)

Published 2026-09-24. Last modified 2026-10-05.