Termix SSH File Manager Command Injection Flaw

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Termix, a web-based server management platform, contains a critical OS command injection vulnerability (CVE-2026-45744, CVSS 9.9) in its SSH file manager's resolvePath endpoint. The flaw stems from inadequate input sanitization—double-quote escaping fails to prevent command substitution via $(...) and backtick syntax. Any authenticated user with an active SSH File Manager session can exploit this to execute arbitrary commands on remote hosts, potentially compromising infrastructure across organizations relying on Termix for server management. This vulnerability is particularly dangerous because it requires only valid authentication, not network-level access, making it an attractive target for insider threats or attackers who have gained initial credentials.

Casky's 419 matched security skills leverage Claude AI with extended reasoning to map this vulnerability against MITRE ATT&CK techniques TA0001 (Initial Access), TA0043 (Reconnaissance), and TA0002 (Execution). Practitioners using Casky would detect attack patterns including: suspicious command construction in HTTP requests to the resolvePath endpoint containing shell metacharacters; unusual process spawning or privilege escalation attempts originating from Termix application contexts; and lateral movement indicators following successful command injection. The platform's skill correlation would highlight CWE-78 (Improper Neutralization of Special Elements used in an OS Command) as the root cause, enabling defenders to identify both in-the-moment exploitation attempts and post-compromise forensic evidence of command execution chains initiated through the vulnerable endpoint.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45744.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-45744

Casky has 419 skills that investigate the attack patterns behind CVE-2026-45744. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn