A critical (CVSS 3.1 9.9) path traversal flaw in Termix-SSH Termix up to version 2.9.2 can be exploited remotely through the destPath argument. A public exploit is available.
What Is It
CVE-2026-120322 is a path traversal vulnerability (CWE-22) in Termix-SSH Termix. The flaw is in how /plugin-api/file-manager/transferToHost processes the destPath argument, which an attacker can manipulate to traverse paths. The researcher's write-up is titled "Termix FileManager transferToHost Arbitrary File Write."
VulDB, the CNA, scores it:
- CVSS 3.1: 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- CVSS 4.0: 8.6 HIGH, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 9.0 HIGH
The NVD record lists its status as "Received," so NVD has not yet completed its own analysis.
Why It Matters
The attack works over the network and has low complexity. It needs only low privileges and no user interaction. The CVSS 3.1 scope is "Changed," which means exploitation can reach resources beyond the vulnerable component. Confidentiality, integrity and availability impacts are all rated High.
The CVE description says the exploit is public and might be used. The sources cited here do not include a report of confirmed exploitation in the wild.
The description also says the vendor was contacted early about the disclosure but did not respond.
What's Vulnerable
- Vendor: Termix-SSH
- Product: Termix
- Affected versions: 2.9.0, 2.9.1, 2.9.2 (described as "up to 2.9.2")
- CPE:
cpe:2.3:a:termix-ssh:termix:*:*:*:*:*:*:*:* - Affected component:
/plugin-api/file-manager/transferToHost,destPathparameter
Patch Status
According to the CVE description, the vulnerable shortcut was removed in: - the standalone File Manager plugin v1.0.0, where the transfer engine now always writes over SFTP - Termix core v26.10.0
Organizations running Termix 2.9.2 or earlier should upgrade to these releases. Defenders should check the CISA Known Exploited Vulnerabilities catalog directly for any later listing and any federal remediation deadline.