CVE-2026-79761

Termix versions 2.5.0 through 2.5.1 have a vulnerability in the /homepage/proxy endpoint that passes the url parameter to http.get or https.get without destination restrictions. URL validation is only syntactic, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. An authenticated low-privilege user can exfiltrate internal service data and cloud credentials.

Termix from version 2.4.0 to 2.5.1 accepted the account password as the sole reauthentication factor in endpoints for disabling TOTP and regenerating backup codes. The refactor regressed the two-factor check, allowing an attacker with a victim's session and knowledge of the password to disable 2FA without access to an authenticator.

Termix from version 1.7.0 to 2.5.1 derived keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt. An attacker with an offline SQLite database copy can derive the wrapping key and decrypt stored SSH passwords, private keys, and key passphrases.

Termix versions 2.5.0 through 2.5.1 allow authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests via the notification-channel test endpoint. The lack of destination allowlisting or private-address blocking permits blind requests to internal HTTP services. The issue is fixed in version 2.5.1.

Termix versions 1.7.0 through 2.5.1, in the POST /credentials/:id/deploy-to-host endpoint, resolves credential and target-host records from attacker-controlled credentialId and targetHostId values without verifying ownership. Differential errors reveal record existence and authType values, and a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. The issue is fixed in version 2.5.1.

Termix versions 1.8.0 through 2.5.1 allow authenticated users to access the server-stats API without per-host authorization. GET /status, GET /status/:id, and POST /clear-connections expose host state and let a regular user clear the global SSH connection pool. The issue is fixed in version 2.5.1.

Termix is a server management platform that prior to version 2.3.2 accepted the account password as the sole authentication factor for MFA-critical operations. An attacker who obtains a user's password can completely disable TOTP or regenerate backup codes, rendering two-factor authentication ineffective.

Termix is a web-based server management platform that prior to version 2.3.2 had 16 file-manager endpoints that did not verify if the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guesses another user's active `sessionId` can access files on the victim's connected SSH host.

Termix, a web-based server management platform, versions 1.7.0 to 1.9.0, has a Stored Cross-Site Scripting (XSS) vulnerability in the File Manager component. The application fails to sanitize SVG file content before rendering, allowing an attacker who has compromised a managed SSH server to plant a malicious file. When previewed by the Termix user, it executes arbitrary JavaScript in the application context. This is fixed in version 1.10.0.

In Termix from 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.