Termix is a web-based server management platform that provides SSH terminal access, tunneling, and file editing. Between versions 1.7.0 and 2.5.0, the SSH-key deployment process builds a grep pattern from a user-controlled public-key token and inserts that pattern into double-quoted shell commands that run on the target host. The verification routines for the keyPattern string allow command substitution or quote-breaking shell syntax. An authenticated user who can deploy a crafted SSH credential can inject shell commands, which the target host will execute with the privileges of the deployed account. This flaw can be leveraged to execute arbitrary commands on the remote system, compromising confidentiality, integrity, and availability.

Termix-SSH:Termix versions from 1.7.0 through 2.5.0 are affected. The vulnerability is present in all releases up to and including 2.5.0 and has been fixed in version 2.5.1.

The CVSS score of 6.6 indicates moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The attack vector is remote but requires a valid authenticated session to the Termix web interface; the attacker can supply a malicious SSH credential that is then used to deploy a key, allowing shell command injection on the selected target host. Successful exploitation would grant the attacker the same privileges as the target account.