Termix hat eine Stored XSS im Dateimanager, die zu Local File Inclusion (LFI) in Electron und Session Hijacking im Browser führt.

An attacker exploiting this vulnerability could gain significant control over a Termix user's session. By compromising a managed SSH server and planting a malicious SVG file, the attacker can trigger the execution of arbitrary JavaScript code when the file is previewed within the Termix File Manager. This could lead to session hijacking, credential theft, unauthorized access to the managed server, and potentially further lateral movement within the network. The impact is amplified if the Termix instance manages critical infrastructure or sensitive data, as the attacker could leverage the compromised session to escalate privileges and access valuable resources.

Organizations utilizing Termix for server management, particularly those managing critical infrastructure or sensitive data, are at risk. Shared hosting environments where multiple users share a Termix instance are especially vulnerable, as a compromised user account could be used to attack other users on the same server.

• javascript / web: Inspect Termix File Manager logs for unusual JavaScript execution patterns or errors related to SVG file previews. • generic web: Use curl to test file upload functionality and attempt to upload a simple SVG file containing a basic JavaScript payload (e.g., <svg onload=alert('XSS')>). • generic web: Examine access logs for requests to the FileViewer.tsx endpoint with SVG file extensions. • generic web: Check response headers for any signs of JavaScript injection after attempting to preview an SVG file.

1. 2026-01-12Disclosure

   disclosure

1. Reserviert2026-01-09
2. Veröffentlicht2026-01-12
3. Geändert2026-01-13
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22804 is to immediately upgrade Termix to version 1.10.0 or later, which contains the necessary fix. If upgrading is not immediately feasible, consider implementing a temporary workaround by disabling SVG file previews within the Termix File Manager. Additionally, implement strict file upload validation to prevent the upload of potentially malicious SVG files. Monitor Termix logs for suspicious activity, particularly related to file previews and JavaScript execution. After upgrading, confirm the fix by attempting to upload and preview a known malicious SVG file – it should not execute JavaScript.