CVE-2026-120322

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22

• https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md
• https://vuldb.com/cve/CVE-2026-120322
• https://vuldb.com/submit/1015028
• https://vuldb.com/vuln/429654
• https://vuldb.com/vuln/429654/cti

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120316http4k before 6.62.0.0-ee contains a path traversal vulnerab…5.9
• CVE-2026-120317http4k from 4.9.10.0 before 6.60.0.0 contains a missing inte…5.9
• CVE-2026-120318Product Gallery Slider & Additional Variation Images for Woo…7.2
• CVE-2026-120319A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. …6.3
• CVE-2026-12032Inappropriate implementation in Passwords in Google Chrome o…3.1
• CVE-2026-120320A vulnerability was determined in jxxghp MoviePilot up to 3.…4.7
• CVE-2026-120323A security flaw has been discovered in samanhappy MCPHub up …4.3
• CVE-2026-120324A weakness has been identified in Aklivity Zilla up to 1.3.4…8.3
• CVE-2026-120325A security vulnerability has been detected in Webpro-nl Knip…6.3
• CVE-2026-120327The click tracking middleware accepts an arbitrary target UR…5.3
• CVE-2026-120328The click tracking middleware does not validate the authenti…6.9
• CVE-2026-120329Saving the configuration of the mail backend module writes s…5.3