Skip to content
Threat Feed
Subscribe
critical advisory

Termix-SSH Termix: Path traversal in transferToHost (CVE-2026-120322)

Termix-SSH Termix versions up to 2.9.2 are vulnerable to remote path traversal via the destPath argument in the /plugin-api/file-manager/transferToHost endpoint.

CVE search metadata

CVE search record: CVE-2026-120322. Severity: critical. CVSS: 9.9. KEV: no. Product: Termix-SSH Termix (<= 2.9.2). Brief: Termix-SSH Termix: Path traversal in transferToHost (CVE-2026-120322). Brief link: https://feed.craftedsignal.io/briefs/2026-11-termix-ssh-traversal/

Triage facts

Revision 1
Applicability
Termix-SSH Termix (<= 2.9.2)
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 2, 03:10 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

CVE-2026-120322 identifies a critical path traversal vulnerability in Termix-SSH Termix versions 2.9.2 and earlier. The flaw exists within the /plugin-api/file-manager/transferToHost endpoint, specifically in the processing of the destPath argument. Successful exploitation allows a remote attacker to manipulate file system operations. The vulnerability has been addressed by forcing file transfers to use SFTP in File Manager plugin v1.0.0 and core version v26.10.0.

Impact

The vulnerability allows remote attackers to perform unauthorized file system operations. Publicly available exploit code exists, increasing the risk of active exploitation.

Recommendation

  • Immediately upgrade Termix-SSH Termix core to version v26.10.0 or higher.
  • Upgrade the File Manager plugin to v1.0.0 or higher.
  • If upgrading is not immediately possible, restrict network access to the /plugin-api/file-manager/transferToHost endpoint.

Immediate actions

Patch Termix-SSH Termix to core v26.10.0 and File Manager plugin v1.0.0

IT Operations 24h

Mitigations

Restrict network access to /plugin-api/file-manager/transferToHost

immediate IT Operations

CVE-2026-120322

Detection coverage 1

Detects CVE-2026-120322 Exploitation - Path Traversal in transferToHost

critical

Detects attempts to exploit CVE-2026-120322 by looking for path traversal sequences in the destPath parameter of the transferToHost endpoint

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →