---
id: CVE-2026-53545
title: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities
summary: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities. Prior to 2.3.2, the DELETE
  /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts
  interpolates endpointP…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53545'
references:
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/pull/874'
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-5p86-jgr7-4hwx
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00537
epssPercentile: 0.44212
ingestedAt: '2026-09-09T21:22:45.543Z'
---

## Overview

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single quote to terminate the pattern and append a shell command, which executes when the tunnel is disconnected. Successful exploitation runs arbitrary commands on the source SSH host with the privileges of the connected SSH account. This issue is fixed in version 2.3.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.