CVE-2026-45746

The vulnerability results from improper validation of the sessionId parameter in the application backend — the server trusts the value provided by the client without verifying whether the session actually belongs to the authenticated user. An attacker can manipulate the sessionId value and gain access to active File Manager sessions of other users. Since File Manager sessions are linked to SSH connections to remote VPS instances, hijacking the session gives the attacker direct access to someone else's file system. Available operations include reading, writing, uploading files and executing them, enabling remote code execution (RCE) on the victim's server.

An attacker can gain full control over someone else's remote VPS server, including reading, modifying and uploading files, and executing arbitrary system commands (RCE), leading to complete violation of the victim's data confidentiality, integrity and availability.

Termix should be updated to version 2.3.2, which contains a fix that removes the vulnerability by properly validating that the sessionId belongs to the authenticated user.

Termix in versions prior to 2.3.2 — a platform for managing servers through a browser with SSH terminal, tunneling and file editing functionality.