Summary
generated automatically from NVD dataTermix-SSH Termix up to 2.9.2 has a path traversal flaw in the /plugin-api/file-manager/transferToHost endpoint, where manipulating the destPath argument lets an attacker reach locations outside the intended directory. It can be triggered remotely, and the description notes a public exploit is available. The shortcut was removed in the standalone File Manager plugin v1.0.0 and in core v26.10.0, while the vendor did not respond to the disclosure. The CVSS v3.1 score is 9.9 (CRITICAL).
NVD description
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 2 nov. 2026
- Updated
- 2 nov. 2026
- Status
- Deferred
- Source
- cna@vuldb.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-22
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.