Termix, a web‑based server management platform, had a flaw that allowed an authenticated administrator to inject shell commands through the ACME/Let’s Encrypt certificate request flow. By storing attacker‑controlled domain and email values via PATCH /users/acme-ssl-settings and later triggering them with POST /users/acme-ssl-request, the backend executed a shell command containing those values. Because the input was only wrapped in double quotes before being passed to child_process.execSync with /bin/sh -c, special shell metacharacters could be used to execute arbitrary operating‑system commands as the Termix backend process. The consequence is full compromise of the Termix instance, exposing its databases, stored credentials, process secrets, and broader network reachability.

The vulnerability affects Termix-SSH Termix versions 2.4.1 through 2.5.1, inclusive. Any deployment of these releases that relies on the ACME certificate request feature is susceptible.

With a CVSS score of 9.1, the flaw represents a high‑severity remote code execution risk. Although EPSS data is not available, the lack of a KEV listing does not diminish the potential impact. The attack requires authenticated administrative access to store domain/email values and to initiate the certificate request; once the shell command is executed, an attacker can run any commands on the host. The combination of privileged backend execution and the ability to inject arbitrary commands places the entire Termix deployment at risk.