CVE-2026-22804

Termix is a server management platform that prior to version 2.3.2 accepted the account password as the sole authentication factor for MFA-critical operations. An attacker who obtains a user's password can completely disable TOTP or regenerate backup codes, rendering two-factor authentication ineffective.

Termix is a web-based server management platform that prior to version 2.3.2 had 16 file-manager endpoints that did not verify if the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guesses another user's active `sessionId` can access files on the victim's connected SSH host.

Termix before version 2.6.1 contains a vulnerability in the GET /host/db/host/:id/password endpoint that does not enforce host ownership during credential resolution. An authenticated user can enumerate host IDs and retrieve SSH or sudo passwords belonging to other users.

Termix before version 2.3.2 contains a vulnerability in the terminal WebSocket that allows an authenticated low-privileged user to use another user's credentials to connect to an attacker-controlled SSH server. This can lead to disclosure of SSH passwords or private keys.

Termix before version 2.3.2 contains a vulnerability in the SSH tunnel teardown path that interpolates user-controlled data into a pkill command pattern. An authenticated user can inject a shell command that executes when the tunnel is disconnected.

Termix is a web-based server management platform that prior to version 2.3.2 had a vulnerability in the `POST /ssh/tunnel/connect` endpoint. This vulnerability allowed OS command injection through user-controlled fields being interpolated directly into a shell command.

Termix is a web-based server management platform that was vulnerable to OS command injection in the GET /ssh/file_manager/ssh/resolvePath endpoint prior to version 2.3.2. This allows authenticated users to execute arbitrary commands on the connected remote host.

Termix prior to version 2.1.0 contains a command injection vulnerability in Docker container management endpoints, where the containerId parameter is directly interpolated into shell commands, allowing an authenticated attacker to achieve remote code execution on the managed server.

In Termix before 2.3.2, the POST /host/db/proxy/test endpoint accepts singleProxy, proxyChain, and testTarget fields without validating destination addresses. The testProxyConnectivity path uses raw TCP and SOCKS connections to attacker-selected hosts and ports, allowing an authenticated user to probe localhost, private networks, link-local metadata services, and other infrastructure. Connection errors disclose host reachability, and metadata access can expose cloud credentials.

In Termix before 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table contains password-reset artifacts, allowing a low-privileged authenticated user to recover another account's reset code and complete the password-reset flow. Successful exploitation results in local-user account takeover and administrative compromise when the victim is an administrator.