How to fix CVE-2026-120322 in Termix: update core and File Manager

Update affected Termix installations to core 26.10.0 or a later supported stable release, and verify File Manager separately. CVE-2026-120322 affects Termix file transfers. The CNA identifies standalone File Manager 1.0.0 as fixed, but its current tag and original release metadata point to different commits. Check the installed artifact as well as its displayed version.

What is affected

The CVE record explicitly lists Termix 2.9.0, 2.9.1 and 2.9.2 as affected and describes path traversal through destPath at /plugin-api/file-manager/transferToHost. Its severity vectors require low privileges.

In the 2.9.2 source, a destination classified as local can route a transfer directly to the filesystem hosting Termix. The fix removes that shortcut from transferFileData and uses SFTP instead.

Check core and plugin versions independently

The verified SHA-256 for that 1.0.0 plugin artifact is:

1cafccfe86a29e2f318026ca7bc20629df94331c81209607976dafd7feac0ca4

Termix moved to calendar versioning at 26.10.0. Core and plugin numbers are separate tracks; an assumed core 2.9.3 is not the verified target.

The plugin release metadata retains an October 6 publication date and older target commit a5294105ae51f3e8c0c27b1a8a6eb5ca330f1c29. The current tag points to the October 10 commit above, after the shortcut fix. The artifact served on November 2 matched both the publisher's digest and core's bundle manifest. That check does not identify when the tag or asset changed, so an older cached file labelled 1.0.0 still needs verification.

Update the installation

1. Inventory both components. Record core and File Manager versions, plugin pins, update settings and artifact identities for each server and desktop installation with its own backend.
2. Back up the full installation. Follow the backup instructions, preserving the data folder, encryption keys and plugins. Back up any external PostgreSQL or MySQL database and rehearse recovery.
3. Update core through the supported path. For Docker Compose, update a pinned image tag before running docker compose pull and docker compose up -d in the existing project. Follow the vendor update instructions for your installation method.
4. Update File Manager in the Plugins tab. Review its pin and pending updates and use the official registry or release artifact. A core-image update alone does not establish that an already installed plugin was replaced.
5. Verify each running instance. Confirm the target core and plugin artifacts, then run the file-transfer and access checks below.

For 2.8 or older, the vendor requires starting 2.9 before 26.10 and having users sign in to complete migration of encrypted data. Schedule that intermediate step in the upgrade window, then continue to the fixed target. Apps and servers should be on matching versions.

Verify transfers and access

Use disposable test hosts and harmless files. Confirm a permitted user can transfer a file to the selected SSH destination, then verify the file's contents and location on that destination. Check transfer failure handling as well as success.

Use separate test identities to verify that a user cannot use another user's file session. Confirm the updated plugin on every instance before closing remediation; one healthy transfer does not establish which artifact another server loaded.

If an update must wait, disable File Manager where feasible and restrict access to Termix and its transfer functionality. Review unexpected transfers or local file changes through your incident-response process. Keep exposure restrictions in place if recovery requires returning to an affected build.

Verification evidence and limits

Ten component checks compared the unchanged transferFileData function from the old core and fixed plugin. With three local-address classifications, the old function chose a local-write stub and the fixed function chose an SFTP stub. A remote-address control chose SFTP on both, and two simulated SFTP failures propagated without local fallback.

Address classification and transfer implementations were stubbed. No live SSH server, complete Termix application, migration or authorization test was run. The test evidence records those limits, source revisions and artifact hashes; use the deployment checks above for the running installation.