CVE-2026-53542

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands unambiguously relative. A user with access to an SSH file-manager session can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar, tar.gz, tar.bz2, or tar.xz creation to interpret those names as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption. This issue is fixed in version 2.3.2.

• CWE-78

• https://github.com/Termix-SSH/Termix/commit/52f4e51ae03b5b8d2608e1383e2ccf79d290132b
• https://github.com/Termix-SSH/Termix/pull/874
• https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-rwj6-6vh7-45pv
• https://github.com/Termix-SSH/Termix/security/advisories/GHSA-rwj6-6vh7-45pv

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53537Python-Multipart is a streaming multipart parser for Python.…5.3
• CVE-2026-53538Python-Multipart is a streaming multipart parser for Python.…3.7
• CVE-2026-53539Python-Multipart is a streaming multipart parser for Python.…7.5
• CVE-2026-5354A flaw has been found in Trendnet TEW-657BRM 1.00.1. Affecte…8.8
• CVE-2026-53540Python-Multipart is a streaming multipart parser for Python.…3.7
• CVE-2026-53541OliveTin gives access to predefined shell commands from a we…4.3
• CVE-2026-53545Termix is a web-based server management platform with SSH te…9.8
• CVE-2026-53546Termix is a web-based server management platform with SSH te…9.6
• CVE-2026-53547Termix is a web-based server management platform with SSH te…8.8
• CVE-2026-53548Termix is a web-based server management platform with SSH te…9.6
• CVE-2026-53549Termix is a web-based server management platform with SSH te…7.7
• CVE-2026-5355A vulnerability has been found in Trendnet TEW-657BRM 1.00.1…8.8