gabrielha12/termix-researchCVE-2026-45746, CVE-2026-45750, CVE-2026-53547 — three critical vulnerabilities in Termix: cross-tenant session hijacking, OS command injection, and account takeover
Vulnerability research on Termix, a web-based SSH and server management platform (13k+ stars).
| CVE | Issue | Severity | Fixed | Advisory |
|---|---|---|---|---|
| CVE-2026-45746 | Session hijacking → RCE | 9.0 Critical | v2.3.2 | GHSA-cx2r-843c-vww8 |
| CVE-2026-45750 | OS command injection | 9.0 Critical | v2.3.2 | GHSA-v26q-rpv5-9m72 |
| CVE-2026-53547 | Account takeover | 8.8 High | v2.3.2 | GHSA-6r97-7wp3-2g3x |
All three come from the same design flaw: the backend checks that a request is authenticated, but never that the data in that request belongs to the user sending it.
45746 — sessionId comes from the client and is sequential. Changing 1 to 2
grants access to another user's SSH session.
45750 — path reaches echo "${escapedPath}". Only double quotes are
escaped, so $(...) survives and executes.
53547 — the export returns the user's own rows alongside the global settings table, where password reset codes are stored.
Chained, they matter more than alone: 45750 by itself runs commands on your own server. With 45746 in front of it, it runs them on someone else's.
