Termix is a web‑based server management platform that provides SSH terminal and tunneling features. A flaw in the POST /ssh/tunnel/connect endpoint allows a user to inject arbitrary content into host record fields which are directly placed into a shell command. This enables a remote attacker to execute any OS command on the host that Termix connects to via SSH, compromising confidentiality, integrity, and availability of that host.

The vulnerability affects Termix version 2.3.1 and earlier. Termix versions prior to 2.3.2 are vulnerable. The attack escalates from the web application to the underlying SSH host.

The CVSS score of 9.8 demonstrates a high severity, and the EPSS score is unavailable. The vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is through the web interface’s tunnel creation endpoint, permitting persistent command injection on the source SSH host.