---
id: "CVE-2026-120322"
kind: "vulnerability"
aliases: ["CVE-2026-120322"]
title: "Termix: path traversal in file transfer endpoint lets remote users write files"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "ssh", "termix"]
not_affected_if: ["fixed-version", "no-file-manager-plugin"]
published_at: "2026-11-02T02:18:47+00:00"
first_seen_at: "2026-11-02T02:23:37+00:00"
updated_at: "2026-11-02T02:24:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120322", "first_seen_at": "2026-11-02T02:23:37+00:00"}]
---

# Termix: path traversal in file transfer endpoint lets remote users write files

Termix, a web-based SSH and server management tool, has a path traversal flaw in its file manager transfer endpoint, where the destPath argument is not sanitized. A remote attacker can use it to write files outside the intended directory on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Termix version; affected versions are up to and including `2.9.2`.
- Check whether the standalone File Manager plugin is installed and whether its version is below `1.0.0`.
- Look for the `/plugin-api/file-manager/transferToHost` endpoint on your Termix deployment.

## Fix

- Move the core Termix install to `26.10.0` or later.
- Move the standalone File Manager plugin to `1.0.0` or later.

## Timeline

- 2026-11-02T02:23:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120322

## From the sources

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_