Termix is a web‑based server management platform that offers SSH terminal, tunneling, and file editing features. In versions prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName endpoint builds a pkill –f pattern by interpolating endpointPort, sourcePort, endpointUsername, and endpointIP into a single‑quoted string. An authenticated user who can edit a tunnel host field can insert a single quote to break out of the quoted string and inject an additional shell command. When the tunnel is torn down, the injected command runs with the privileges of the connected SSH account, allowing the attacker to execute arbitrary commands on the source host. The flaw is resolved in release 2.3.2.

The vulnerability affects all Termix‑SSH installations before release 2.3.2. Users running any pre‑2.3.2 version of Termix are exposed. The patch was introduced in version 2.3.2, which removes the unsafe string interpolation.

The flaw carries a CVSS score of 9.8, classifying it as critical. Although EPSS data is not available, the capability to inject commands and the reliance on a web interface suggest that a remote attacker who has authenticated access to the Termix management console can exploit it. The vulnerability is not currently listed in CISA’s KEV catalog, but the high severity and the requirement for only authorized access mean that it should be treated as a high‑risk threat whenever the affected version is deployed.