CVE-2026-45746

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.

• CWE-284
• CWE-639

• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8Exploit, Mitigation, Vendor Advisory
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-cx2r-843c-vww8Exploit, Mitigation, Vendor Advisory

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45739Strawberry GraphQL is a library for creating GraphQL APIs. I…4.3
• CVE-2026-4574A vulnerability was detected in SourceCodester Simple E-lear…6.3
• CVE-2026-45740protobufjs compiles protobuf definitions into JavaScript (JS…7.5
• CVE-2026-45743Termix is a web-based server management platform with SSH te…8.1
• CVE-2026-45744Termix is a web-based server management platform with SSH te…9.9
• CVE-2026-45745Termix is a web-based server management platform with SSH te…8
• CVE-2026-45748Termix is a web-based server management platform with SSH te…9.8
• CVE-2026-45749Termix is a web-based server management platform with SSH te…8.1
• CVE-2026-4575A flaw has been found in code-projects Exam Form Submission …2.4
• CVE-2026-45750Termix is a web-based server management platform with SSH te…9
• CVE-2026-45753Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-45754Symfony is a PHP framework for web and console applications …5.3