The vulnerability resides in the Termix‑SSH Termix application and arises from improper handling of the destPath argument in the /plugin‑api/file-manager/transferToHost endpoint. This flaw allows an attacker to inject a path traversal sequence that causes the server to write a file to an arbitrary location on the host file system. The result is an arbitrary file write that can be used to delete or overwrite configuration files, or to drop malicious executables or scripts, based on the description, it is inferred that this could lead to remote code execution. The weakness is a classic Path Traversal (CWE‑22).

Termix‑SSH Termix versions up to 2.9.2 are affected. The flaw is present in the core application and was also mitigated by removing the shortcut in the standalone File Manager plugin v1.0.0 and updating the core to v26.10.0.

The CVSS score of 9.4 classifies this as a critical vulnerability. No EPSS score is available, but proof‑of‑concept code exists and could be used by an attacker with remote access to the API. The vulnerability can be triggered remotely without authentication, making it highly exploitable. The lack of a vendor response and the public availability of the exploit raise the likelihood of real‑world attacks, although the vulnerability is not currently listed in the CISA KEV catalog.