On this page (7 sections)
A path traversal vulnerability, tracked as CVE-2026-120322, has been published for Termix-SSH Termix up to version 2.9.2. According to the GitHub Advisory Database entry, the flaw sits in the File Manager endpoint /plugin-api/file-manager/transferToHost and involves the destPath argument. The advisory says it can be attacked remotely and that a public exploit is available.
If you run a self-hosted Termix instance, especially one reachable from the internet or shared with other users, check your version now. The advisory text says a shortcut was removed in the standalone File Manager plugin v1.0.0 and in core v26.10.0, but it lists affected and patched versions as unknown, so treat those versions as the likely fix rather than a confirmed one.
What happened
The vulnerability was published on November 2, 2026. The description says the manipulation of the destPath argument in the transferToHost handler leads to path traversal, and that the attack may be started remotely. A linked write-up in the references is titled as an arbitrary file write, which suggests the impact is writing files to locations the application should not allow. We have not independently verified that write-up, so treat the exact impact as reported by the researcher.
The advisory also states that the vendor was contacted early about the disclosure but did not respond in any way. The sources do not say who made the statement about the shortcut being removed, and the vendor has not been shown confirming it. That matters for planning: do not wait for a separate vendor announcement, and verify any release yourself before relying on it.
Technical details
Path traversal (CWE-22) happens when an application builds a file path from user-supplied input without confining it to an intended directory. By including parent-directory sequences or absolute paths, a caller can make the application read or write outside the folder it was meant to use. When the operation is a file transfer, the result can be files created or overwritten in unexpected places on the host.
The CVSS v4 metrics listed in the advisory are: network attack vector, low attack complexity, no attack requirements, low privileges required, no user interaction, and high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems. In plain terms, an attacker needs a low-privileged account but no victim interaction, and the possible consequences are broad.
The advisory text says the shortcut was removed and that the transfer engine now always writes over SFTP. That implies the vulnerable code path was a shortcut that bypassed the normal SFTP route. This is an inference from the wording, not a statement from the vendor.
Who is affected
- Operators of Termix instances running version 2.9.2 or earlier.
- Teams that installed the File Manager plugin, since the vulnerable endpoint is under /plugin-api/file-manager/.
- Instances exposed to the internet or to many internal users, because the attack needs only low privileges and works over the network.
- Shared or multi-user deployments where any authenticated user could otherwise be trusted only with limited access.
The sources do not say whether instances without the File Manager plugin are exposed, and they do not list versions between 2.9.2 and 26.10.0. If you are unsure, assume you are affected until you have confirmed your version.
How to check your exposure
Start by finding which Termix version and File Manager plugin version you run. How you do this depends on your deployment, so use the application's own settings or about page, or your container image tag if you deploy with containers.
This read-only command lists running containers with their image names and tags, so you can spot a Termix image and its version (run on the Docker host; look for a tag at or below 2.9.2):
docker ps --format '{{.Names}} {{.Image}} {{.Status}}'This search through your reverse proxy access log looks for requests to the vulnerable endpoint, so you can see who has called it. Adjust the log path to your setup; any hits from unfamiliar addresses deserve a closer look:
grep 'plugin-api/file-manager/transferToHost' /var/log/nginx/access.logMatches alone do not prove abuse, since legitimate users also transfer files. Look for unusual destPath values, unknown source IPs, or requests followed by unexpected file changes.
What to do now
0 of 7 done
If you cannot update immediately, limiting who can reach the instance is the most practical stopgap. A web application firewall can add a layer in front of an exposed app, but it is not a substitute for patching. See what a WAF is for what it can and cannot do.
Detection and monitoring afterwards
Keep access logging enabled on whatever sits in front of Termix and retain it long enough to review. Alert on requests to the file-manager plugin API from addresses outside your expected range, and on file changes in system directories on the Termix host.
If the instance is public, a scheduled outside-in check helps you notice unexpected changes to the exposed service, such as certificate or header changes. Webforta Monitor covers uptime, certificate, DNS and header-change monitoring. It will not tell you whether this specific flaw is present, so version checks and log review remain your main tools. For broader hygiene on small deployments, see small business website security.
If you suspect the host was already tampered with, follow the steps in website hacked: what to do.
Timeline
| Date | Event |
|---|---|
| Before Nov 2, 2026 | Researcher contacts the vendor early; the advisory says there was no response |
| Nov 2, 2026 | CVE-2026-120322 published to NVD and the GitHub Advisory Database |
| Not stated | Release dates of File Manager plugin v1.0.0 and core v26.10.0 |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.