CVE-2026-120322

Name of the Vulnerable Software and Affected Versions Termix-SSH Termix versions prior to 26.10.0

Description A path traversal issue exists in the processing of the '/plugin-api/file-manager/transferToHost' endpoint. A remote attacker with low-privilege authentication can manipulate the destPath argument to access or overwrite files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly neutralized.

Recommendations Update to core version 26.10.0. Update the File Manager plugin to version 1.0.0. Restrict access to the '/plugin-api/file-manager/transferToHost' endpoint as a temporary mitigation.