CVE-2026-45748

{
  "id": "CVE-2026-45748",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-05T18:17:31.000",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue."
    },
    {
      "lang": "es",
      "value": "Termix es una plataforma de gestión de servidores basada en web con capacidades de terminal SSH, tunelización y edición de archivos. El endpoint ’POST /ssh/tunnel/connect’ en Termix anterior a la versión 2.3.2 construye un comando de túnel SSH interpolando campos de registro de host controlados por el usuario (’endpointIP’, ’endpointUsername’, ’password’) directamente en un comando de shell sin escape, lo que permite la inyección de comandos de SO persistente en el host SSH de origen. La versión 2.3.2 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Termix-SSH",
          "product": "Termix",
          "versions": [
            {
              "version": "< 2.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-09T00:00:00+00:00",
          "id": "CVE-2026-45748",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.1.0",
              "versionEndExcluding": "2.3.2",
              "matchCriteriaId": "093A7241-2F44-4CF9-A881-7B83370ABB49"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/Termix-SSH/Termix/releases/tag/release-2.3.2-tag",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-xmjh-8cc2-qm49",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/Termix-SSH/Termix/security/advisories/GHSA-xmjh-8cc2-qm49",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}