CVE-2026-120322

CriticalCVSS 9.9/10Last modified Nov 2, 2026

Description

A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Termix-SSH	Termix	2.9.0; 2.9.1; 2.9.2

References

Timeline

Published: Nov 2, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1203234.3A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthrou CVE-2026-1203248.3A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file CVE-2026-1203256.3A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packag CVE-2026-1203264.8DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header without escaping it. When CVE-2026-1203275.3The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect use CVE-2026-1203286.9The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can CVE-2026-1203295.3Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configura CVE-2026-120335.3Out of bounds read in VideoCapture in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the GPU process to CVE-2026-1203307.1Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or rec CVE-2026-1203315.3Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend us CVE-2026-1203325.1The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can in CVE-2026-1203338.8The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with