Termix is a web-based server management platform with SSH capabilities. In versions before 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint improperly sanitizes the user-supplied path parameter by embedding it inside double quotes in a shell command executed over an active SSH session. Although double quotes are escaped, shell command substitution syntax such as $(...) is still processed by the remote shell, leading to an OS command injection vulnerability (CWE-78). This allows an attacker with at least limited privileges (PR:L) and user interaction (UI:R) to execute arbitrary commands with potentially high impact on confidentiality, integrity, and availability. The issue is resolved in version 2.3.2.

Successful exploitation can lead to remote execution of arbitrary commands on the server via the SSH session, resulting in full compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 score is 9.0 (critical), reflecting network attack vector, low attack complexity, limited privileges required, user interaction needed, and scope change with high impact on all security properties.

Upgrade Termix to version 2.3.2 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgraded, avoid exposing the vulnerable endpoint to untrusted users or restrict access to trusted users only.