CVE-2026-79766

Executive Summary

CVE-2026-79766 is an OS command injection vulnerability (CWE-78) in Termix, a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. An authenticated Termix administrator can supply attacker-controlled domain and email values via PATCH /users/acme-ssl-settings, which are later interpolated into a certbot shell command invoked through child_process.execSync (via /bin/sh -c) during POST /users/acme-ssl-request, allowing arbitrary OS command execution as the Termix backend process. With a CVSS score of 9.1, impact includes exposure of Termix databases, process secrets, stored credentials, and full network reachability from the compromised backend host.

Technical Analysis

The vulnerability resides in the ACME/SSL certificate management flow of Termix. Two HTTP endpoints participate in the attack chain, both explicitly identified in the NVD description:

1. PATCH /users/acme-ssl-settings — stores administrator-supplied ACME configuration, specifically domain and email values.
2. POST /users/acme-ssl-request — triggers certificate issuance, which invokes certbot.

The backend implementation file src/backend/database/routes/acme-ssl-routes.ts uses child_process.execSync to spawn a shell (/bin/sh -c) with a certbot command string. The user-controlled domain and email values are inserted into that command string with only double-quote wrapping, and no shell metacharacter escaping. Because /bin/sh interprets metacharacters inside an unescaped command string, values containing shell syntax can break out of the intended argument context and execute arbitrary commands.

This is a classic CWE-78 OS Command Injection. The root weaknesses are:

• Building a shell command via string interpolation rather than argument-vector invocation (execFile/spawn with an argv array).
• Relying on double-quote wrapping as a sanitization boundary, which does not neutralize shell metacharacters such as command separators, substitution operators, or newline injection depending on how the surrounding command is constructed.
• Privileged, authenticated-only trigger surface (administrator role), which limits the pre-condition to authenticated actors but does not reduce the severity given the administrator role's inherent capabilities.

Both ACME challenge configuration modes are affected per the description: the HTTP webroot mode and the DNS Cloudflare challenge mode. That means the injection point is reachable regardless of which validation method the deployment uses, widening the affected configuration set. The vulnerable version window is explicitly from 2.4.1 until 2.5.1; version 2.5.1 is the fixed release.

No public PoC or exploit code is available, and no Nuclei template exists. All technical statements here derive from the NVD description; no additional implementation details are asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the endpoints/parameters explicitly named in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an internet-exposed or internally reachable Termix instance running a version between 2.4.1 and 2.5.0. Identification is straightforward: Termix exposes a login interface and, once authenticated as an administrator, the ACME SSL settings interface. Exposed instances can be enumerated via search engines using the Termix login/UI fingerprints.

2. Access pre-condition. The attacker must hold a Termix administrator account (CVSS PR:H). This may be obtained via credential reuse, phishing, a compromised admin session, or an insider threat. No unauthenticated path is described for this CVE.

3. Payload staging. The attacker sends PATCH /users/acme-ssl-settings with a domain or email value that contains shell metacharacters. Because the backend wraps these values only in double quotes before interpolation into the certbot command, the injected syntax survives into the shell command line.

4. Trigger and execution. The attacker sends POST /users/acme-ssl-request. The backend executes child_process.execSync → /bin/sh -c → certbot with the tainted command string. The injected metacharacters cause the shell to interpret and execute attacker-supplied OS commands as the Termix backend process user. This works in both HTTP webroot and DNS Cloudflare challenge configurations.

5. Post-exploitation. Per the NVD description, successful exploitation exposes:

   • Termix databases (including the user/settings data used to reach this point),
   • process secrets (environment variables, JWT/session signing material, API tokens),
   • stored credentials (SSH credentials managed by the platform, likely including the very hosts Termix administers),
   • network reachability from the backend host (pivoting into the internal network Termix can reach).

   Because Termix centrally manages SSH access to many servers, compromise of the backend effectively compromises the managed fleet. The CVSS scope change (S:C) reflects that the exploited component (the shell/certbot execution context) affects resources beyond the vulnerable component.

Impact Assessment

Confidentiality: High. Command execution as the backend process grants access to the Termix database, process environment secrets, and stored credentials for managed hosts. Integrity: High. The attacker can modify configuration, inject into managed systems, or tamper with certificate issuance and stored data. Availability: High. Arbitrary OS-level control of the backend process allows disruption of Termix, its managed endpoints, and TLS/certificate operations.

Exploitability. AV:N (attack reachable over the network), AC:L (no special conditions beyond the metacharacter injection), PR:H (administrator account required), UI:N (no user interaction). The scope change (S:C) is significant: a compromise of the Termix backend escapes the boundary of that single component and impacts the hosts and networks it administers.

Blast radius. Termix is a server management platform; a Termix backend typically holds SSH credentials, tunnels, and file-edit access to a fleet of servers. Successful exploitation therefore plausibly yields lateral movement across every server under Termix management, plus any network reachable from the backend host. Concentrated credential storage makes Termix a high-value single point of compromise.

Real-world likelihood. The requirement of an authenticated administrator account constrains opportunistic mass exploitation. However, the vulnerability is attractive to insider threats, to attackers who have already obtained admin credentials, and in post-compromise escalation scenarios. No EPSS score is available, and no exploitation in the wild has been reported.

Detection Guidance

No public PoC signatures exist, so the following detections focus on the vulnerability class: attacker-controlled domain/email values flowing into the ACME settings and certbot command execution.

Sigma Rule

title: Potential Termix ACME SSL Shell Command Injection Attempt
id: 6d2c9f3a-1c2b-4e7a-9b0f-9a5e7c1f4a21
status: experimental
description: Detects HTTP requests to Termix ACME SSL endpoints containing shell metacharacters, consistent with CVE-2026-79766 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79766
author: Valters IT
date: 2026/01/01
logsource:
  category: web
  product: termix
detection:
  selection_endpoint:
    uri|endswith:
      - '/users/acme-ssl-settings'
      - '/users/acme-ssl-request'
  selection_metachar:
    - 'domain|contains':
        - ';'
        - '|'
        - '`'
        - '$( '
        - '$('
        - '&&'
        - '||'
    - 'email|contains':
        - ';'
        - '|'
        - '`'
        - '$('
        - '&&'
        - '||'
  condition: selection_endpoint and selection_metachar
falsepositives:
  - Legitimate unusual domain values (rare)
level: high

YARA Rule

rule CVE_2026_79766_Termix_ACME_CommandInjection
{
    meta:
        description = "Detects Termix ACME SSL route source containing execSync shell interpolation (CVE-2026-79766)"
        author = "Valters IT"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79766"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $f1 = "acme-ssl-routes" ascii
        $a1 = "acme-ssl-settings" ascii
        $a2 = "acme-ssl-request" ascii
        $e1 = "execSync" ascii
        $e2 = "/bin/sh -c" ascii
        $c1 = "certbot" ascii
        $d1 = "domain" ascii
        $m1 = "email" ascii

    condition:
        (uint16(0) != 0x5A4D) and
        (($f1 and $e1) or ($a1 and $a2 and $e1) or ($e1 and $e2 and $c1)) and
        ($d1 or $m1) and
        filesize < 2MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79766 Termix ACME SSL Shell Command Injection Attempt"; flow:to_server,established; http.method; content:"PATCH"; http.uri; content:"/users/acme-ssl-settings"; http.request_body; pcre:"/(domain|email)[^,}]{0,64}(;|\||`|\$\(|&&|\|\|)/i"; reference:cve,CVE-2026-79766; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79766; classtype:web-application-attack; sid:9007976; rev:1;)

Elastic Detection

process where event.type == "start" and
process.parent.name in ("node", "nodejs") and
process.name in ("sh", "bash", "/bin/sh") and
process.args : "*/bin/sh -c*" and
process.args : "*certbot*" and
process.args : ("*acme-ssl*" or "*acme_ssl*")

Splunk SPL Query

index=web OR index=proxy
(method="PATCH" uri="*/users/acme-ssl-settings*") OR (method="POST" uri="*/users/acme-ssl-request*")
| eval inj=if(match(body, "(?i)(domain|email)[^,}]{0,64}(;|\||`|\$\(|&&|\|\|)"), "METACHARACTER", "clean")
| where inj="METACHARACTER"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| sort - count

Wazuh OSSEC Rule

<group name="web,termix,cve-2026-79766">
  <rule id="100776" level="12">
    <if_sid>31100</if_sid>
    <id>^/(users/acme-ssl-settings|users/acme-ssl-request)$</id>
    <match>domain|email</match>
    <regex>(domain|email).{0,64}(;|\||`|\$\(|&&|\|\|)</regex>
    <description>CVE-2026-79766: Termix ACME SSL command injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_79766,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). Although the NVD description states the issue is fixed in version 2.5.1, no patch reference URL, commit, or advisory has been captured by any tracked source; treat this as unverified until an authoritative patch reference is confirmed.

1. Immediate mitigations

   • Restrict network access to Termix administrative interfaces. Do not expose Termix admin endpoints (/users/acme-ssl-settings, /users/acme-ssl-request, and the admin UI generally) to untrusted networks. Place them behind a VPN, zero-trust proxy, or IP allowlist.
   • Enforce strong, unique administrator credentials and MFA where available; apply least privilege so that non-administrator users cannot reach ACME settings.
   • Audit administrative accounts and revoke any that are unnecessary, unused, or shared.
   • Temporarily disable the ACME/SSL certificate settings interface if it is not required, and avoid specifying untrusted domain/email values.
   • Monitor for metacharacters in domain/email fields and alert on suspicious admin activity in ACME settings.

2. Patch / upgrade steps

   • Upgrade to Termix 2.5.1 or later, which the NVD description identifies as the fixed release. Verify the release through the vendor's official distribution channel and confirm the version after upgrade.
   • Because patch verification failed (0/4 sources), contact the Termix maintainer if a formal advisory/commit cannot be located, and confirm the fix addresses the child_process.execSync//bin/sh -c interpolation in src/backend/database/routes/acme-ssl-routes.ts.
   • If the fix cannot be applied, treat the deployment as vulnerable and rely on the network and access-control mitigations above.

3. Long-term hardening

   • Replace shell-string execution with argument-vector invocation (execFile/spawn with an argv array) for all external commands such as certbot, eliminating shell metacharacter interpretation.
   • Apply strict allowlist validation to domain and email inputs (RFC-compliant domain and email parsing) before any use in certificate operations.
   • Harden secrets management: rotate Termix process secrets, stored credentials, and managed-host SSH keys after any suspected exposure, and move credentials to a dedicated secrets store.
   • Segment the Termix backend network so that a backend compromise does not grant broad lateral reach, given the CVSS scope-change (S:C) rating.
   • Establish SBOM/subcomponent monitoring for Termix and the ACME toolchain (certbot), and adopt continuous detection for command injection patterns in externally facing management platforms.

References

• NVD — CVE-2026-79766: https://nvd.nist.gov/vuln/detail/CVE-2026-79766
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (verified: CVE-2026-79766 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Termix project repository (vendor source; advisory/commit not confirmed at time of writing).

No known threat actor campaigns, public PoC, exploit code, or exploit-in-the-wild evidence are associated with CVE-2026-79766 at the time of this report. EPSS has not yet scored this CVE.