CVE-2026-120322 — A 9.9 Path Traversal in Termix-SSH's File Manager

If you self-host Termix for SSH management, this one needs your attention today.

CVE-2026-120322 is a CVSS 9.9 path traversal in the File Manager plugin's
/plugin-api/file-manager/transferToHost endpoint. The destPath argument
isn't sanitised — pass ../../../etc/cron.d/backdoor and that's where your
file lands.

The short version

CVE	CVE-2026-120322
CVSS 3.1	9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Auth required	Yes — low-privileged session only
Public exploit	Yes, PoC available
Vendor response	None
Fixed in	Core v26.10.0 · File Manager plugin v1.0.0

Why it's a 9.9 with PR:L

The S:C (scope change) in the vector is the key. The impact leaves the web
application and hits the underlying host filesystem. A low-priv Termix user
writing to /etc/, a webroot, or a cron directory is not a web-app problem
anymore — it's a host problem.

The fix is architectural, not a patch

The developer didn't sanitise the path. They removed the shortcut that bypassed
SFTP entirely. Every transfer in v1.0.0/v26.10.0 now goes over SFTP, where the
SSH server's own permissions constrain the destination.

Worth noting: upgrading replaces the app, not the filesystem. If your instance
was reachable before the fix, check what's on disk.

What to do

1. Upgrade both: core to v26.10.0 and the standalone File Manager plugin to v1.0.0. Both are required.
2. If you can't upgrade today: block /plugin-api/file-manager/transferToHost at your reverse proxy.
3. Check your logs for ../ or %2e%2e%2f in destPath.
4. Audit the host filesystem — unexpected files in /etc, cron dirs, or webroots are the post-exploitation artefact to look for.
5. Rotate SSH keys and tokens the affected account could reach.

---

Full analysis with detection guidance and ATT&CK mapping at
ThreatAft.