PT-2026-47016 · Termix Ssh · Termix

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-45743

NVD

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by sessionId. An authenticated attacker who knows or guesses another user's active sessionId can read, write, delete, download, and execute files on the victim's connected SSH host. Version 2.3.2 patches the issue.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-45743

Affected Products

Termix

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-45743 · Security Note
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-5fqh-77cr-jj5x · Note
• https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag · Note