CVE-2026-79766

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-79766
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79766.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-79766
Aliases
  • GHSA-pr55-25gf-5f9v
Published
2026-09-24T16:00:49Z
Modified
2026-09-25T03:48:42Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email
Details

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/79xxx/CVE-2026-79766.json"
}
References

Affected packages

Git / github.com/termix-ssh/termix

Affected ranges

Type
GIT
Repo
https://github.com/termix-ssh/termix
Events
Introduced
d1a8dcf3c6953515c03bbaf45112580310e90a38
Fixed
ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.4.1"
        },
        {
            "fixed":  "2.5.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

release-2.*
release-2.4.1-tag
release-2.5.0-tag

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-79766.json"