CVE-2026-120322

Summary

A path traversal vulnerability exists in Termix-SSH up to version 2.9.2 via the /plugin-api/file-manager/transferToHost endpoint, where manipulation of the 'destPath' argument allows an authenticated attacker to write files outside intended directories.

Exploitability

Exploitation requires low-privilege authentication (PR:L) and no user interaction (UI:N), with the exploit publicly available, making exploitation straightforward for attackers with valid credentials.

Blast radius

Successful exploitation could lead to full system compromise including confidentiality, integrity, and availability impacts due to arbitrary file writes on the host, potentially enabling remote code execution or credential theft.

Detection

Monitor for HTTP requests to /plugin-api/file-manager/transferToHost containing path traversal sequences (e.g., '..' or absolute paths) in the 'destPath' parameter, especially from low-privilege users; such requests are not expected in normal operation.

Prioritized remediation

Upgrade to Termix core v26.10.0 or later, or apply the standalone File Manager plugin v1.0.0 (which disables the vulnerable transfer engine and switches to SFTP-only transfers).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.