Termix-SSH Termix File Manager Path Traversal Vulnerability

A vulnerability has been identified in Termix-SSH Termix up to 2.9.2. The issue affects processing of the file /plugin-api/file-manager/transferToHost, where manipulation of the destPath argument leads to path traversal.

The attack may be initiated remotely, and the exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond.

• Affected versions: Termix-SSH Termix up to 2.9.2
• Fixed in: standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and core v26.10.0