{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/termix-ssh-termix--2.9.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:termix:termix-ssh_termix:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-120322"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Termix-SSH Termix (\u003c= 2.9.2)"],"_cs_severities":["critical"],"_cs_tags":["webserver","path-traversal","cve"],"_cs_type":"advisory","_cs_vendors":["Termix"],"content_html":"\u003cp\u003eCVE-2026-120322 identifies a critical path traversal vulnerability in Termix-SSH Termix versions 2.9.2 and earlier. The flaw exists within the \u003ccode\u003e/plugin-api/file-manager/transferToHost\u003c/code\u003e endpoint, specifically in the processing of the \u003ccode\u003edestPath\u003c/code\u003e argument. Successful exploitation allows a remote attacker to manipulate file system operations. The vulnerability has been addressed by forcing file transfers to use SFTP in File Manager plugin v1.0.0 and core version v26.10.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows remote attackers to perform unauthorized file system operations. Publicly available exploit code exists, increasing the risk of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade Termix-SSH Termix core to version v26.10.0 or higher.\u003c/li\u003e\n\u003cli\u003eUpgrade the File Manager plugin to v1.0.0 or higher.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, restrict network access to the \u003ccode\u003e/plugin-api/file-manager/transferToHost\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-02T03:10:44Z","date_published":"2026-11-02T03:10:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-termix-ssh-traversal/","summary":"Termix-SSH Termix versions up to 2.9.2 are vulnerable to remote path traversal via the destPath argument in the /plugin-api/file-manager/transferToHost endpoint.","title":"Termix-SSH Termix: Path traversal in transferToHost (CVE-2026-120322)","url":"https://feed.craftedsignal.io/briefs/2026-11-termix-ssh-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Termix-SSH Termix (\u003c= 2.9.2)","version":"https://jsonfeed.org/version/1.1"}