CVE-2026-53542

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53542

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53542.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53542

Aliases

GHSA-rwj6-6vh7-45pv

Published

2026-08-19T20:35:58Z

Modified

2026-09-11T03:30:53Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Termix: Tar option injection in file-manager archive creation allows command execution on managed SSH hosts

Details

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands unambiguously relative. A user with access to an SSH file-manager session can select basenames beginning with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec, causing tar, tar.gz, tar.bz2, or tar.xz creation to interpret those names as options. The resulting checkpoint action executes commands on the managed SSH host with the privileges of the connected SSH account, allowing file disclosure, modification, and service disruption. This issue is fixed in version 2.3.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53542.json"
}

References

Affected packages

Git / github.com/termix-ssh/termix

Affected ranges

Type

GIT

Repo

https://github.com/termix-ssh/termix

Events

Introduced

Fixed

52f4e51ae03b5b8d2608e1383e2ccf79d290132b

Fixed

c3282b5dca081d52513e94329bbc71084338217d

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-1.*

release-1.10.0-tag

release-1.11.0-tag

release-1.11.1-tag

release-1.11.2-tag

release-1.4.0-tag

release-1.5.0-tag

release-1.6.0-tag

release-1.7.0-tag

release-1.7.1-tag

release-1.7.2-tag

release-1.7.3-tag

release-1.8.0-tag

release-1.9.0-tag

release-2.*

release-2.0.0-tag

release-2.1.0-tag

release-2.2.0-tag

release-2.2.1-tag

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53542.json"