Summary
CVE-2026-79766: Termix 2.4.1-2.5.1 command injection via ACME/Let's Encrypt admin-controlled domain/email.
Affected Asset
Termix 2.4.1 – 2.5.1 (Termix-SSH — ACME SSL settings injection via PATCH/POST certbot interpolation).
Affected Endpoint
SSH session / connection handler
Prerequisites
Termix 2.4.1 – 2.5.1; authenticated account with administrator privileges able to call PATCH /users/acme-ssl-settings and POST /users/acme-ssl-request.
Steps to Reproduce
As admin, call PATCH /users/acme-ssl-settings with crafted domain/email values, then POST /users/acme-ssl-request to interpolate attacker-controlled strings into the certbot shell command.
Evidence
Public advisory (Noxen) and NVD entry; confirmed container escape demonstrations on Proxmox / LXC homelab setups.
Impact
Full host compromise; attacker can execute shell commands on the host by triggering certbot-mediated command interpolation.
Root Cause
runc did not properly restrict access to host-side file descriptors within the container's /proc view, allowing a malicious container to reference and chdir into leaked descriptors.
Remediation
Update runc to 1.1.12+; on Proxmox: apt update && apt dist-upgrade (pve-container / lxc-pve packages from Feb 2024); verify with runc --version.
Verification Steps
Confirm Termix version is >= 2.5.1; verify the ACME settings endpoint requires admin privileges and that certbot commands are properly quoted/interpolated.