Threats tagged 'ghsa-49pf-hq35-qwjq'

CVE-2026-120322 is a critical path traversal vulnerability in Termix-SSH Termix up to version 2.9.2. It involves improper handling of the destPath argument in the /plugin-api/file-manager/transferToHost endpoint, allowing remote attackers to traverse directories. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. The issue was mitigated by removing the vulnerable shortcut in the standalone File Manager plugin v1.0.0 and core v26.10.0. No official vendor response or patch is currently available.