CVE-2026-42453: Termix: Command injection in extractArchive/compressFiles via double-quote escaping bypass
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.1.0, the extractArchive and compressFiles endpoints in file-manager.ts use double-quoted strings for shell command construction, unlike all other file manager operations which use single-quote escaping. Double quotes allow $(command) substitution, enabling command injection on the remote SSH host. This issue has been patched in version 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42453?
CVE-2026-42453 is considered a critical vulnerability due to the potential for command injection exploits.
How do I fix CVE-2026-42453?
To fix CVE-2026-42453, upgrade to Termix version 2.1.0 or later.
What are the affected components in CVE-2026-42453?
CVE-2026-42453 affects the extractArchive and compressFiles endpoints in the Termix file-manager.
Can CVE-2026-42453 lead to unauthorized access?
Yes, CVE-2026-42453 can potentially allow an attacker to execute arbitrary commands, leading to unauthorized access.
Who is impacted by CVE-2026-42453?
Any users of Termix prior to version 2.1.0 are impacted by CVE-2026-42453.