CVE-2026-79764

🗓️ 24 Sep 2026 16:02:48Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 27 Views🌐 WEB

Authenticated SSRF in Termix 2.5.0 via /homepage/proxy allows internal data exfiltration.

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2026-79764 Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist	24 Sep 202616:02	–	cvelist
EUVD	EUVD-2026-86199	24 Sep 202616:02	–	euvd
NVD	CVE-2026-79764	24 Sep 202617:17	–	nvd
Positive Technologies	PT-2026-97922	24 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-79764: Server-Side Request Forgery (SSRF)	24 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-79764 Termix: Authenticated SSRF via `/homepage/proxy` — No Destination Allowlist	24 Sep 202616:02	–	vulnrichment

Vulners

Node

termix termix-sshRange2.5.0–2.5.1

[
  {
    "vendor": "Termix-SSH",
    "product": "Termix",
    "versions": [
      {
        "version": ">= 2.5.0, < 2.5.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag
github	www.github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg
github	www.github.com/Termix-SSH/Termix/pull/1067
github	www.github.com/Termix-SSH/Termix/commit/4b2a60a854281d0e12e7c9bcde71854a81999ea0
github	www.github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e

Parameter	Position	Path	Description	CWE
url	query param	/homepage/proxy	Authenticated users can provide a destination URL via the url query parameter to the /homepage/proxy endpoint, which proxies the request using http.get/https.get without destination restrictions, enabling SSRF and exfiltration of internal data and cloud credentials.	CWE-918

24 Sep 2026 19:39Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.7

EPSS0.0042

SSVC

CWE-918