{
  "cve": "CVE-2026-120322",
  "product": "Termix-SSH Termix",
  "originalPublishedAt": "2026-11-02T01:45:41.924Z",
  "researchedAt": "2026-11-02T14:06:03.264809+00:00",
  "originalPublicationLocalDate": "2026-11-01",
  "timezone": "America/Los_Angeles",
  "classification": "software",
  "report": {
    "testedAt": "2026-11-02T14:03:14.686Z",
    "node": "v24.22.1",
    "typescript": "5.9.3",
    "scope": "Extracted upstream routing function; classification and transfer callees stubbed. No full application, live SSH, traversal or exploit test.",
    "passed": 10,
    "results": [
      {
        "revision": "old",
        "address": "127.0.0.1",
        "failSftp": false,
        "route": "local",
        "passed": true,
        "extractedSha256": "8d406b4d896bb446000ae5cf8ff821209866a588d1f4e42c5b119118c6f80000"
      },
      {
        "revision": "old",
        "address": "::1",
        "failSftp": false,
        "route": "local",
        "passed": true,
        "extractedSha256": "8d406b4d896bb446000ae5cf8ff821209866a588d1f4e42c5b119118c6f80000"
      },
      {
        "revision": "old",
        "address": "localhost",
        "failSftp": false,
        "route": "local",
        "passed": true,
        "extractedSha256": "8d406b4d896bb446000ae5cf8ff821209866a588d1f4e42c5b119118c6f80000"
      },
      {
        "revision": "old",
        "address": "192.0.2.20",
        "failSftp": false,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "8d406b4d896bb446000ae5cf8ff821209866a588d1f4e42c5b119118c6f80000"
      },
      {
        "revision": "fixed",
        "address": "127.0.0.1",
        "failSftp": false,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "4906c7d6990323f030d3a93aed8c9c48c289457b45e956ed741a609d30e94515"
      },
      {
        "revision": "fixed",
        "address": "::1",
        "failSftp": false,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "4906c7d6990323f030d3a93aed8c9c48c289457b45e956ed741a609d30e94515"
      },
      {
        "revision": "fixed",
        "address": "localhost",
        "failSftp": false,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "4906c7d6990323f030d3a93aed8c9c48c289457b45e956ed741a609d30e94515"
      },
      {
        "revision": "fixed",
        "address": "192.0.2.20",
        "failSftp": false,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "4906c7d6990323f030d3a93aed8c9c48c289457b45e956ed741a609d30e94515"
      },
      {
        "revision": "old",
        "address": "192.0.2.20",
        "failSftp": true,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "8d406b4d896bb446000ae5cf8ff821209866a588d1f4e42c5b119118c6f80000"
      },
      {
        "revision": "fixed",
        "address": "127.0.0.1",
        "failSftp": true,
        "route": "sftp",
        "passed": true,
        "extractedSha256": "4906c7d6990323f030d3a93aed8c9c48c289457b45e956ed741a609d30e94515"
      }
    ]
  },
  "sandbox": {
    "sessionId": "sbx_6k5CBzGcrXzBbcWvDxEUxs2uygsx",
    "vcpus": 1,
    "memoryMiB": 2048,
    "timeoutMs": 900000,
    "persistent": false,
    "ports": [],
    "mounts": [],
    "networkPolicyAtTest": "deny-all",
    "policyReadBackVerified": true,
    "status": "stopped",
    "stoppedAt": "2026-11-02T14:03:27.863Z"
  },
  "sources": [
    {
      "purpose": "canonical record",
      "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120322.json"
    },
    {
      "purpose": "complete mirror",
      "url": "https://casco.com/cve/CVE-2026-120322/record.json"
    },
    {
      "purpose": "core release",
      "url": "https://github.com/Termix-SSH/Termix/releases/tag/v26.10.0"
    },
    {
      "purpose": "plugin release",
      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/tag/v1.0.0"
    },
    {
      "purpose": "fix commit",
      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/commit/2bad8d88f7a7b16e576f174297d8f675a496ec32"
    },
    {
      "purpose": "fixed pinned source",
      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/blob/d52b21cd35aa3c9c82cdba4c5c18777c220b4697/src/backend/transfer-engine.ts"
    },
    {
      "purpose": "vulnerable pinned source",
      "url": "https://github.com/Termix-SSH/Termix/blob/2b309e9582b83297bca3931a10af747dafd4a8e3/plugins/file-manager/src/backend/transfer-engine.ts"
    },
    {
      "purpose": "core bundle manifest",
      "url": "https://github.com/Termix-SSH/Termix/blob/014926092638088c1c30b91e0b0df77ff171158b/docker/bundled-plugins.json"
    },
    {
      "purpose": "operator report and maintainer confirmation",
      "url": "https://github.com/Termix-SSH/Support/issues/1428"
    },
    {
      "purpose": "official update instructions",
      "url": "https://docs.termix.site/install/updating/"
    },
    {
      "purpose": "backup instructions",
      "url": "https://docs.termix.site/install/backup/"
    }
  ],
  "severity": [
    {
      "version": "4.0",
      "score": 9.4,
      "source": "VulDB"
    },
    {
      "version": "3.1",
      "score": 9.9,
      "source": "VulDB"
    }
  ],
  "versions": {
    "affectedExplicit": ["2.9.0", "2.9.1", "2.9.2"],
    "cnaNarrative": "through 2.9.2",
    "fixedCore": "26.10.0",
    "fixedStandalonePlugin": "1.0.0",
    "coreCommit": "014926092638088c1c30b91e0b0df77ff171158b",
    "oldCoreCommit": "2b309e9582b83297bca3931a10af747dafd4a8e3",
    "pluginTagCommit": "d52b21cd35aa3c9c82cdba4c5c18777c220b4697",
    "pluginFixCommit": "2bad8d88f7a7b16e576f174297d8f675a496ec32",
    "releaseMetadataTargetCommit": "a5294105ae51f3e8c0c27b1a8a6eb5ca330f1c29",
    "releaseMetadataCaveat": "The v1.0.0 release retains its original October 6 publication/target metadata; the currently resolved tag is an October 10 revision containing the fix. Version label alone does not identify those bytes."
  },
  "downloads": [
    {
      "name": "old.ts",
      "sha256": "1842c384f15e3aa920198ac13d87431065269067224729506726ce0105d0a11d",
      "bytes": 95908
    },
    {
      "name": "fixed.ts",
      "sha256": "539a711d5fd1fc3e60c1560a37b1b6d205983fb884ee4341444ece2b53540a69",
      "bytes": 93757
    },
    {
      "name": "file-manager-1.0.0.tmxplug",
      "sha256": "1cafccfe86a29e2f318026ca7bc20629df94331c81209607976dafd7feac0ca4",
      "bytes": 7487258,
      "matchedOfficialReleaseDigestAndCoreManifest": true
    }
  ],
  "discussionResearch": {
    "researchedAt": "2026-11-02T14:06:00Z",
    "platforms": [
      "Hacker News",
      "Reddit",
      "LinkedIn",
      "X/Twitter",
      "GitHub issues/discussions",
      "vendor/operator forums"
    ],
    "queries": [
      "CVE-2026-120322",
      "Termix-SSH Termix transferToHost destPath",
      "Termix File Manager 2.9.2 26.10.0 26.10.1",
      "Termix same machine file transfer"
    ],
    "exactCveConversationsVerified": 0,
    "selected": [
      {
        "url": "https://github.com/Termix-SSH/Support/issues/1428",
        "createdAt": "2026-10-09T16:05:58Z",
        "updatedAt": "2026-10-10T20:04:27Z",
        "commentsRead": 2,
        "reactions": 0,
        "relation": "Operator bug report directly linked by fix commit; maintainer says shipped in26.10.0",
        "sameVulnerabilityEvidence": "Shortcut-removal commit 2bad8d88f7a7b16e576f174297d8f675a496ec32 explicitly references this issue; maintainer confirms shipped in26.10.0. Functional defect report predates CVE ID."
      }
    ],
    "drafts": "docs/security/cve-2026-120322-review.md",
    "limitations": "No posting. Search visibility does not establish absence. Older unrelated-CVE LinkedIn posts and different-product HN thread excluded.",
    "selectedUrls": ["https://github.com/Termix-SSH/Support/issues/1428"],
    "rejectedBackground": [
      {
        "url": "https://www.reddit.com/r/selfhosted/comments/1x4tn0i/termix_v26101_plugins_official_community/",
        "createdAt": null,
        "visibleTopLevelCommentsRead": 6,
        "totalComments": null,
        "score": null,
        "relation": "Adjacent plugin-release and update-frequency conversation",
        "limitations": "Only visible replies read. Cached relative timestamps inconsistent with crawl date; absolute date and engagement totals not verified. JSON and old.reddit.com fetch unavailable. No-AI flair and disclosure debate require current human review.",
        "reason": "General release/update discussion does not discuss this same vulnerability; excluded from reply shortlist."
      }
    ],
    "sameVulnerabilityConversationsVerified": 1
  },
  "ogChecks": {
    "sourceLogo": "public/logo-wide.svg",
    "source": "public/blog/cve-2026-120322-termix-remediation/og-image.svg",
    "asset": "/blog/cve-2026-120322-termix-remediation/og-image.png",
    "width": 1200,
    "height": 630,
    "visuallyInspected": true,
    "correctCve": true,
    "actualLogoPathsAndColorsPreserved": true,
    "contrastAndProportionsChecked": true,
    "sha256": "239c37d1ac259c571616ebfcf516f75116fe440095ce7bd9b40829a070225b52"
  },
  "validation": {
    "ci": "passed (existing warnings only)",
    "cveTests": {
      "passed": 80,
      "failed": 0
    },
    "previewBuild": "passed",
    "renderedCanonical": true,
    "previewNoindex": true,
    "previewListing": true,
    "ogAndTwitterTags": "https://casco.com/blog-og/cve-2026-120322-termix-remediation/image.png",
    "ogRouteServesExactAsset": true
  }
}