Termix versions before 2.1.0 contain a command injection vulnerability (CWE-77) in the extractArchive and compressFiles endpoints of the file manager module. These endpoints construct shell commands using double quotes, which permit command substitution through $(command) syntax on the remote SSH host. This contrasts with other file manager operations that use safer single-quote escaping. The vulnerability allows an unauthenticated attacker to execute arbitrary commands remotely via the SSH interface. The vulnerability is fixed in version 2.1.0.

An attacker can exploit this vulnerability to execute arbitrary commands on the remote SSH host without authentication, potentially leading to full system compromise. The CVSS 4.0 base score is 8.7 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity. No known exploits have been reported in the wild.

Upgrade Termix to version 2.1.0 or later, where this command injection vulnerability has been patched. Since no official remediation level or patch link is provided, verify the upgrade from the vendor's official release notes or repository. No other mitigation is indicated by the vendor advisory.