The vulnerability identified as CVE-2026-45748 affects Termix, a web-based server management platform. Specifically, the POST /ssh/tunnel/connect endpoint in versions before 2.3.2 improperly neutralizes special elements in user-controlled input fields used to build an SSH tunnel command. Because these inputs are interpolated directly into a shell command without escaping, an attacker can inject OS commands that execute on the source SSH host. This is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The issue is resolved in version 2.3.2.

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands on the source SSH host with the privileges of the Termix process. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade Termix to version 2.3.2 or later, where this OS command injection vulnerability has been fixed. Since the vendor advisory or patch links are not explicitly provided, verify the upgrade from official Termix sources. Until patched, do not expose the vulnerable endpoint to untrusted users or networks. Patch status is not yet confirmed by vendor advisory content; check official Termix communications for current remediation guidance.