Termix-SSH's Termix platform versions >=2.4.1 and <2.5.1 contain an OS command injection vulnerability (CWE-78) where authenticated administrators can supply attacker-controlled domain and email values via PATCH /users/acme-ssl-settings. These values are then interpolated into a certbot shell command executed by child_process.execSync in the backend without proper sanitization, allowing arbitrary OS command execution. Both HTTP webroot and DNS Cloudflare challenge modes are vulnerable. This can lead to full compromise of Termix backend process privileges, exposing sensitive data and network access. The vulnerability is addressed in version 2.5.1.

An authenticated Termix administrator can execute arbitrary operating system commands with the privileges of the Termix backend process. This can lead to complete compromise of the Termix environment, including exposure of databases, process secrets, stored credentials, and network reachability. The vulnerability affects both HTTP webroot and DNS Cloudflare challenge modes, increasing the attack surface and potential impact.

A fix is available in Termix version 2.5.1. Users should upgrade to version 2.5.1 or later to remediate this vulnerability. Since this is a cloud-hosted service, the vendor manages remediation for the cloud environment; users should verify with the vendor that their service instances are updated accordingly.