Termix Path Traversal Flaw: What to Update
Published · Termix · 1 CVE · NVD and CISA KEV checked November 3, 2026
In short Termix versions 2.9.2 and earlier have a remote path traversal flaw. Upgrade to 26.10.0 or later and verify the installed release.
What happened
Termix has addressed a path traversal vulnerability in its Termix product. Think of it like a delivery instruction that lets someone send a package beyond the room where deliveries belong. In this case, a destination supplied to a file-transfer operation can lead outside the intended directory.
The vendor advisory identifies Termix versions 2.9.2 and earlier as affected and 26.10.0 and later as fixed. The vulnerability is tracked as CVE-2026-120322. NVD published its entry on 2026-11-02 and assigns the issue a HIGH severity rating.
The issue involves the file manager's transfer operation and can be attacked remotely. NVD also reports that exploit material is publicly available. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-11-03.
Technical details
The weakness is path traversal, classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory. A pathname tells software where to find or place a file. Path traversal occurs when software accepts a path that reaches beyond the directory boundaries the operation should enforce.
For CVE-2026-120322, the relevant operation is transferToHost, and the affected argument is destPath. That argument supplies the destination for a file transfer. The reported behavior means the destination was not adequately confined to its intended directory. The description does not identify the exact validation mistake, so a more specific explanation of the faulty code would go beyond what is documented.
The attack can be initiated remotely against the affected transfer processing. The description does not establish whether authentication or particular permissions are required. Developers and administrators should therefore avoid assuming either that every remote visitor can trigger it or that a login requirement makes an affected installation safe.
NVD assigns a CVSS 4.0 score of 8.6, rated HIGH. CVSS is a standardized way to describe vulnerability severity; it is not a measurement of how likely a particular installation is to be attacked. The documented correction removes the transfer shortcut so that transfers use SFTP, a file-transfer protocol that operates over an encrypted connection.
Weakness types: Path traversal
Who is affected
Everyday users
If you use Termix, the practical question is which version runs the service you connect to. Versions 2.9.2 and earlier fall within the affected range. If someone else manages that service, ask them to confirm its version and arrange the update.
This advisory concerns how Termix handles a file-transfer destination. It does not establish that your files have been accessed or changed. Updating addresses the documented weakness; determining whether anything happened to a particular installation is a separate question.
Developers
Developers maintaining Termix deployments or integrations should identify any workflow that relies on the affected file-transfer operation. The security boundary here is the destination directory: accepting a destination string should not allow the transfer to escape that boundary.
When validating the update, pay attention to the transfer workflow your application actually uses. A successful ordinary transfer can confirm that a workflow still functions, but it cannot by itself demonstrate that path traversal is prevented. Confirm the fixed release as well as expected transfer behavior.
Server and IT admins
For server and IT administrators, the affected version range provides the clearest starting point for inventory and patch planning. Identify the Termix services you manage, record their running versions, and schedule affected installations for an update following the vendor advisory.
Because the flaw can be reached remotely, review who can reach the affected service while planning the update. Exposure affects how urgently a deployment needs attention, but it does not change whether its installed version is affected.
What to do now
- Identify the Termix installations you use or administer and confirm the running version of each.
- Treat Termix 2.9.2 and earlier as affected by CVE-2026-120322.
- Review the vendor advisory for the update procedure and any deployment-specific instructions.
- Upgrade affected installations to Termix 26.10.0 or later. Follow the update steps in the vendor's advisory.
- After updating, confirm the running release and check that the file-transfer workflows you depend on still behave as expected.
If you can't update yet
- If an update must wait, check the vendor advisory for guidance on restricting access to the affected service and reducing its internet exposure.
- Check the vendor advisory for whether disabling the affected file-transfer feature is supported as a temporary measure.
How to confirm the fix
- Confirm that the Termix service actually running is version 26.10.0 or later; downloading an update alone does not establish that the active service uses it.
- Follow any post-update verification instructions in the vendor advisory.
- Check a routine, authorized file transfer and confirm that it reaches the intended destination. Treat this as a functionality check alongside version verification.
- Repeat version verification for each Termix installation you administer so an older deployment is not overlooked.
NVD scores and CISA KEV status
As of November 3, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.
| CVE | CVSS | Severity | Weakness (CWE) | KEV |
|---|---|---|---|---|
| CVE-2026-120322 | 8.6 (v4.0) | High | CWE-22 | Not listed |
Affected products and fixed versions 1 rows
| Product | Affected versions | Fixed version / action | CVE |
|---|---|---|---|
| Termix | 2.9.2 and earlier | 26.10.0 and later | CVE-2026-120322 |
The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.
Frequently asked questions
Which Termix versions are affected, and which release fixes the issue?
Termix 2.9.2 and earlier are affected. The vendor identifies 26.10.0 and later as fixed. Follow the update steps in the vendor's advisory.
Does path traversal mean an attacker can run commands?
Path traversal means a file path can escape its intended directory boundary. For this advisory, the documented issue concerns a transfer destination. The description does not establish command execution, so that outcome should not be assumed.
Does the public exploit mean my installation was attacked?
No conclusion about a particular installation follows from the availability of exploit material. NVD reports that an exploit is publicly available, but that does not establish what happened on your service. Confirm your running version and apply the vendor's fix.
References
- Termix advisory: https://github.com/0xGenesi/CVE/blob/main/Termix_FileManager_transferToHost_Arbitrary_File_Write.md
- Termix advisory: https://github.com/Termix-SSH/Termix/releases
- NVD: CVE-2026-120322
- CISA Known Exploited Vulnerabilities catalog
- Also reported by KISA (Korea Internet & Security Agency) on November 3, 2026: KISA advisory (Korean)
How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.