Termix File Manager Session Hijacking via Broken Access Control

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Termix, a web-based server management platform offering SSH terminal, tunneling, and file editing capabilities, contains a critical broken access control vulnerability in its File Manager functionality prior to version 2.3.2. The flaw stems from improper validation of the sessionId parameter, where the backend trusts client-controlled identifiers without verifying ownership. This allows attackers to manipulate session IDs and gain unauthorized access to active File Manager sessions belonging to other authenticated users. With a CVSS score of 9, this vulnerability poses severe risk to organizations relying on Termix for server administration, potentially exposing sensitive files, credentials, and system configurations to lateral movement and data exfiltration attacks.

Casky's skill set maps this vulnerability to privilege escalation (TA0004) and credential access (TA0006) techniques under MITRE ATT&CK. When practitioners analyze Termix traffic and logs through Casky's 261 matching skills, they would identify suspicious patterns including: unauthorized sessionId parameter manipulation across HTTP requests, access to File Manager resources without corresponding user authentication records, cross-session file operations from non-owning accounts, and anomalous file access patterns originating from single source IPs targeting multiple session identifiers. Claude's extended reasoning capabilities enable practitioners to correlate these indicators—distinguishing between legitimate concurrent sessions and actual hijacking attempts—while the mapped security skills provide context-aware detection of both active exploitation and post-compromise lateral movement leveraging compromised file manager sessions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45746.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-45746

Casky has 261 skills that investigate the attack patterns behind CVE-2026-45746. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn