---
id: CVE-2026-53549
title: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities
summary: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test
  endpoint accepts the singleProxy, proxyChain, and testTarget request fields
  withou…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-918
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53549'
references:
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/pull/874'
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9pr-795g-rm5f
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9pr-795g-rm5f
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00535
epssPercentile: 0.44082
ingestedAt: '2026-09-09T21:22:45.544Z'
---

## Overview

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure reachable from the Termix server. Structured connection errors disclose host reachability and timing information, and successful metadata access can expose cloud credentials. This issue is fixed in version 2.3.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.