CVE-2026-53542: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Termix-SSH Termix

Termix-SSH Termix versions before 2.3.2 contain an OS command injection vulnerability (CWE-78) in the archive creation functionality implemented in src/backend/ssh/file-manager.ts. The issue arises because selected file basenames are passed directly to the tar command without an end-of-options marker and without ensuring operands are relative paths. Maliciously crafted basenames starting with GNU tar options such as --checkpoint=1 and --checkpoint-action=exec cause tar to interpret these as options rather than filenames. This leads to execution of arbitrary commands on the managed SSH host with the privileges of the connected SSH account. The vulnerability allows unauthorized file disclosure, modification, and potential service disruption. The issue is resolved in Termix version 2.3.2.

An attacker with access to an SSH file-manager session can exploit this vulnerability to execute arbitrary commands on the managed SSH host with the privileges of the connected SSH user. This can lead to disclosure and modification of files and disruption of services on the host system.

Upgrade Termix to version 2.3.2 or later, where this vulnerability has been fixed by properly handling file basenames passed to the tar command. No other mitigation is required as the fix is official and addresses the root cause.