VYPR
← All advisories
High severity8.0OSV Advisory· Published Jan 12, 2026· Updated Jun 17, 2026

CVE-2026-22804

CVE-2026-22804

Description

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 to 1.9.0, Stored Cross-Site Scripting (XSS) vulnerability exists in the Termix File Manager component. The application fails to sanitize SVG file content before rendering it. This allows an attacker who has compromised a managed SSH server to plant a malicious file, which, when previewed by the Termix user, executes arbitrary JavaScript in the context of the application. The vulnerability is located in src/ui/desktop/apps/file-manager/components/FileViewer.tsx. This vulnerability is fixed in 1.10.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Termix SSH/TermixOSV3 versions
    release-1.7.0-tag, release-1.7.1-tag, release-1.7.2-tag, …+ 2 more
    • (no CPE)range: release-1.7.0-tag, release-1.7.1-tag, release-1.7.2-tag, …
    • cpe:2.3:a:termix:termix:*:*:*:*:*:*:*:*range: >=1.7.0,<1.10.0
    • (no CPE)range: 1.7.0 - 1.9.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.