CVE-2026-79764: Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. The endpoint returns the complete fetched JSON response, so a low-privilege or self-registered account can exfiltrate internal service data and cloud credentials. This issue is fixed in version 2.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Termixto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Termix versions from 2.5.0 through versions before 2.5.1 are affected. The vulnerable endpoint can reach loopback, RFC1918, link-local, and cloud metadata destinations from the Termix server.
What access does an attacker need?
An attacker needs an authenticated Termix account and can exploit the issue with low-privilege or self-registered access. No user interaction is required.
What can an attacker obtain through the proxy endpoint?
The endpoint returns the complete fetched JSON response. This can expose data from internal services and cloud credentials available through metadata endpoints.
How can I determine whether a system is affected?
Check the deployed Termix version and whether users can access the /homepage/proxy endpoint while running a version before 2.5.1. The vulnerable behavior accepts a url query parameter without destination restrictions.
What is the available remediation?
Upgrade Termix to version 2.5.1, which fixes the issue.