The vulnerability in the Termix web-based management platform permits an attacker to gain remote code execution rights on a victim’s VPS. The back‑end accepts a sessionId parameter that is supplied by the client and is not verified against the actively authenticated user. As a result, an attacker can forge the sessionId of another user’s active File Manager session and invoke file editing, uploading, or execution functions. This broken access control escalates to full control over the victim’s remote file system, effectively giving the attacker the same privileges as the original user’s SSH session.

The flaw exists in Termix versions earlier than 2.3.2. All installations of Termix that expose the File Manager functionality are affected, regardless of deployment size. Administrators using Termix to manage multiple VPS instances should consider all users that could connect via SSH.

The CVSS score of 9.0 classifies this as high severity, and the vulnerability is listed as not yet part of the CISA KEV catalog. Exploitation requires the attacker to target a known or guessable sessionId and to interact with the Termix web interface, a reasonable attack vector for a user with access to the deployment or via phishing. Because EPSS is not available, the concrete probability of exploitation is uncertain, but the high CVSS and the ability to execute arbitrary commands on customer VPS make the risk significant.