If you self-host Termix for SSH management, this one needs your attention today.

CVE-2026-120322 is a CVSS 9.9 path traversal in the File Manager plugin's

/plugin-api/file-manager/transferToHost endpoint. The destPath argument

isn't sanitised — pass ../../../etc/cron.d/backdoor and that's where your

file lands.

The short version

CVE CVE-2026-120322

CVSS 3.1 9.9 Critical ( AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H )

Auth required Yes — low-privileged session only

Public exploit Yes, PoC available

Vendor response None

Fixed in Core v26.10.0 · File Manager plugin v1.0.0

Why it's a 9.9 with PR:L

The S:C (scope change) in the vector is the key. The impact leaves the web

application and hits the underlying host filesystem. A low-priv Termix user

writing to /etc/ , a webroot, or a cron directory is not a web-app problem

anymore — it's a host problem.

The fix is architectural, not a patch

The developer didn't sanitise the path. They removed the shortcut that bypassed

SFTP entirely.…