CVE-2026-45744 is an OS command injection vulnerability in Termix, a web-based server management platform. The flaw exists in the GET /ssh/file_manager/ssh/resolvePath endpoint prior to version 2.3.2, where shell commands are constructed using double-quote escaping that fails to prevent command substitution mechanisms such as $(...) and backticks. This allows any authenticated user with an active File Manager SSH session to execute arbitrary commands on the remote host connected through Termix. The vulnerability has a CVSS 3.1 score of 9.9, indicating critical severity. The issue is fixed in version 2.3.2.

An authenticated user with an active File Manager SSH session can execute arbitrary OS commands on the remote host, potentially leading to full compromise of the connected system. The vulnerability affects confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

Upgrade Termix to version 2.3.2 or later, where this OS command injection vulnerability is patched. Since the vendor advisory does not provide additional remediation details, applying this official fix is the recommended action. Patch status is not explicitly confirmed beyond the version update, so verify with the vendor advisory for the latest remediation guidance.