---
id: CVE-2026-79760
title: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities
summary: >-
  Termix is a web-based server management platform with SSH terminal, tunneling,
  and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows
  authenticated users to configure webhook or ntfy notification channels with
  attacker-cont…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L'
cwe:
  - CWE-918
vendor: Termix-SSH
product: Termix
affected:
  - 'Termix >= 2.5.0, < 2.5.1'
published: '2026-09-24'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T13:22:04.673'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79760'
references:
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/commit/e1d1a3e53d65794ec2f23099bafe77fdfdd11648
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/pull/1067'
    label: security-advisories@github.com
  - url: 'https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Termix-SSH/Termix/security/advisories/GHSA-6hx3-9mgq-h9fj
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.824Z'
---

## Overview

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.