The vulnerability arises from the tar command being invoked with unescaped file basenames that can include GNU tar options, representing a CWE-78 Command Injection weakness. A user who can interact with the SSH file‑manager can craft basenames such as --checkpoint=1 and --checkpoint-action=exec and cause tar, tar.gz, tar.bz2, or tar.xz to interpret them as options, resulting in arbitrary command execution on the managed host with the privileges of the connected SSH account, enabling file disclosure, modification and service disruption.

Termix‑SSH Termix versions earlier than 2.3.2 are affected.

The computed CVSS score of 8.8 indicates high severity. EPSS is not available and the vulnerability is not listed in CISA KEV. Attack requires authenticated access to an SSH file‑manager session, and the attacker can trigger tar command injection to execute commands on the target host. The threat is significant due to full remote command execution with the SSH account’s privileges.