{"id":"CVE-2026-120322","kind":"vulnerability","aliases":["CVE-2026-120322"],"related":[],"title":"Termix: path traversal in file transfer endpoint lets remote users write files","description":"A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Termix, a web-based SSH and server management tool, has a path traversal flaw in its file manager transfer endpoint, where the destPath argument is not sanitized. A remote attacker can use it to write files outside the intended directory on the host.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","ssh","termix"],"not_affected_if":["fixed-version","no-file-manager-plugin"],"how_to_check":"- Check the installed Termix version; affected versions are up to and including `2.9.2`.\n- Check whether the standalone File Manager plugin is installed and whether its version is below `1.0.0`.\n- Look for the `/plugin-api/file-manager/transferToHost` endpoint on your Termix deployment.","fix":"- Move the core Termix install to `26.10.0` or later.\n- Move the standalone File Manager plugin to `1.0.0` or later.","status":"open","published_at":"2026-11-02T02:18:47+00:00","first_seen_at":"2026-11-02T02:23:37+00:00","triaged_at":"2026-11-02T02:24:30+00:00","updated_at":"2026-11-02T02:24:30+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T02:24:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move the core Termix install to `26.10.0` or later.\n- Move the standalone File Manager plugin to `1.0.0` or later.","reach":"internet","title":"Termix: path traversal in file transfer endpoint lets remote users write files","impact":"high","summary":"Termix, a web-based SSH and server management tool, has a path traversal flaw in its file manager transfer endpoint, where the destPath argument is not sanitized. A remote attacker can use it to write files outside the intended directory on the host.","audience":"businesses","category":"other","nicknames":[],"who_cares":["termix","self-hosted","ssh"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker writes files to arbitrary paths on the server","analyst_note":"Confirm from the vendor advisory whether authentication is required and whether the file manager plugin is on by default; the sources only cite NVD.","how_to_check":"- Check the installed Termix version; affected versions are up to and including `2.9.2`.\n- Check whether the standalone File Manager plugin is installed and whether its version is below `1.0.0`.\n- Look for the `/plugin-api/file-manager/transferToHost` endpoint on your Termix deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-file-manager-plugin"],"who_is_affected":"Teams that run a self-hosted Termix instance up to version 2.9.2 with the file manager plugin enabled are exposed, since the flaw sits in the transfer endpoint that handles file uploads to the host. Deployments that have upgraded to the fixed versions or that do not expose the Termix web interface to remote users are not affected by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000739,"input_tokens":4200,"output_tokens":638,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120322':15A,18A '-2026':14A,17A '/plugin-api/file-manager/transfertohost':90C '2.9.2':80C 'affect':83C 'alway':130C 'argument':49B,95C 'attack':55B,102C 'avail':111C 'base':29B 'contact':141C 'core':136C 'cve':13A,16A 'destpath':48B,96C 'directori':65B 'disclosur':145C 'earli':142C 'endpoint':7A,45B 'engin':128C 'exploit':108C 'file':5A,12A,42B,61B,89C,123C 'flaw':39B 'host':22B,68B 'identifi':72C 'initi':105C 'intend':64B 'issu':82C 'lead':97C 'let':8A 'manag':33B,43B,124C 'manipul':92C 'may':103C 'might':113C 'outsid':62B 'path':2A,37B,99C 'plugin':125C 'process':86C 'public':110C 'remot':9A,54B,106C 'remov':119C 'respond':149C 'sanit':52B 'self':21B 'self-host':20B 'server':32B 'sftp':133C 'shortcut':117C 'ssh':23B,30B,76C 'standalon':122C 'termix':1A,24B,25B,75C,77C 'termix-ssh':74C 'tool':34B 'transfer':6A,44B,127C 'travers':3A,38B,100C 'unknown':85C 'use':57B,115C 'user':10A 'v1.0.0':126C 'v26.10.0':137C 'vendor':139C 'vulner':70C 'way':152C 'web':28B 'web-bas':27B 'write':11A,60B,131C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Termix instance up to version 2.9.2 with the file manager plugin enabled are exposed, since the flaw sits in the transfer endpoint that handles file uploads to the host. Deployments that have upgraded to the fixed versions or that do not expose the Termix web interface to remote users are not affected by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","other","selfhosted","ssh","termix"],"first_public_at":"2026-11-02T02:18:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120322","severity":null,"published_at":"2026-11-02T02:18:47+00:00","modified_at":"2026-11-02T02:18:47+00:00","first_seen_at":"2026-11-02T02:23:37+00:00","fetched_at":"2026-11-02T02:23:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}