Termix’s File Manager component accepts a path parameter that is concatenated into a shell command executed on the server’s SSH session. Because only double quotes are escaped, command substitution syntax such as $(…) is still interpreted by the remote shell, allowing an attacker to inject arbitrary shell commands. The vulnerability is an OS Command Injection (CWE‑78) that can be triggered by a user with access to the web interface, potentially leading to full remote code execution on the host with the privileges of the SSH session.

The vulnerability affects all Termix‑SSH Termix releases older than version 2.3.2, specifically 2.3.1 and earlier. Any deployment of Termix that has not applied the 2.3.2 release is susceptible.

The CVSS score of 9 indicates a critical severity, and while the EPSS score is not available, the lack of a KEV listing does not reduce the risk of exploitation. The attack can be carried out remotely by sending a crafted GET request to the /ssh/file_manager/ssh/resolvePath endpoint from an authenticated session, which then executes the injected payload on the backend server.