Termix is a web‑based server management platform that offers SSH terminal, tunneling, and file editing features. Between versions 2.5.0 and the release that fixed the issue, the /homepage/proxy endpoint accepts an authenticated user's URL query parameter and forwards it to http.get or https.get with no destination restrictions. The new URL constructor performs only syntactic validation, allowing the request to target loopback, RFC1918, link‑local, and cloud metadata addresses. Because the endpoint returns the fetched JSON directly, any authenticated user—including low‑privilege or self‑registered accounts—can retrieve internal service data and cloud credentials. This flaw is a classic instance of Server‑Side Request Forgery identified by CWE‑918 and can lead directly to data exfiltration or lateral movement within the host.

The affected product is Termix from Termix‑SSH. The vulnerability exists in releases before 2.5.1, specifically version 2.5.0. Version 2.5.1 includes the fix that imposes a destination allowlist, so installations running 2.5.0 or earlier are impacted.

The CVSS score of 7.7 indicates high severity, while the EPSS score is currently not available and the vulnerability is not listed in CISA's KEV catalog. The attack vector requires only authentication, which is widely granted to many accounts, and the endpoint returns the raw JSON response. This allows an attacker to probe internal services and cloud‑metadata endpoints and exfiltrate credentials or other sensitive information. The absence of a destination allowlist makes the vulnerability a critical internal breach vector, and the wide authentication scope and high impact make timely remediation essential.