Termix is a web-based server management platform that enables SSH terminal, tunneling, and file editing. A flaw in the extractArchive and compressFiles endpoints of the file manager layer was discovered: the code builds shell commands using double-quoted strings instead of single-quoted escaping, which allows command substitution such as $(command). An attacker who can invoke these endpoints can therefore inject arbitrary commands that are executed on the remote SSH host, leading to full control over the server. The weakness is an instance of CWE‑77, which describes command injection vulnerabilities.

The vulnerable product is Termix managed by Termix‑SSH. All releases before version 2.1.0 are affected. Endpoints impacted are extractArchive and compressFiles in file‑manager.ts. Users running older Termix versions should upgrade to 2.1.0 or later to receive the fix.

The CVSS score of 8.7 ranks this issue as High severity. No EPSS data is available, so the current exploitation probability cannot be quantified. The vulnerability is not yet listed in the CISA KEV catalog. The damage is limited to those who can authenticate to the file manager and invoke the vulnerable endpoints; however, once accessed, the attacker can run arbitrary commands on the backend SSH host.