CVE-2026-53542: Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands unambiguously relative. A user with access to an SSH file-manager session can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar, tar.gz, tar.bz2, or tar.xz creation to interpret those names as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption. This issue is fixed in version 2.3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termix (file-manager archive creation endpoint src/backend/ssh/file-manager.ts)to a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Termix deployments before 2.3.2 are exposed when users can access an SSH file-manager session and create archives. Command execution occurs on the managed SSH host under the privileges of the SSH account connected through Termix.
What does an attacker need to exploit it?
The attacker needs access to a Termix SSH file-manager session and must be able to select files whose basenames begin with GNU tar option strings, such as --checkpoint=1 and --checkpoint-action=exec. No additional user interaction is required.
Which archive operations are affected?
Archive creation for tar, tar.gz, tar.bz2, and tar.xz formats is affected because selected filenames can be interpreted as tar options.
What should be done to remediate the issue?
Upgrade Termix to version 2.3.2, which fixes the archive creation handling. If upgrading cannot occur immediately, restrict access to SSH file-manager sessions and prevent untrusted users from creating or selecting option-like filenames for archive operations.
What is the likely impact if exploitation succeeds?
An attacker can execute commands on the managed SSH host with the connected SSH account's privileges. The described impacts include file disclosure, file modification, and service disruption.