2.6 KiB
termix — triage (group C, 2026-10-27)
Pin: ghcr.io/lukegus/termix:2.8.0 (server image only). setup_gate + signup_block (/users/create) + ALLOW_REGISTRATION=false after setup. No X-Forwarded-For strip middleware (unlike paperless/sparky R-753).
Version line
2.8.0 -> 2.9.0/2.9.1/2.9.2 -> 26.10.0 (2026-10-10, "Termix now uses calendar versions"). 26.10.0 notes: "Downgrading to 2.8 is no longer supported. A 2.8 install has to start 2.9 once before upgrading" => a required intermediate step. ghcr.io/lukegus/termix tags read 2026-10-27: 2.9.2, 26.10.0..26.10.5, plus 26.10.5-minimal / -full variants (26.10.5: default image ships the most-used plugins).
Notices (12)
NOT-A-FINDING (2): GHSA-frx8-qqgg-7j7g (Termix Desktop embedded backend), GHSA-r9gw-3w87-mhh7 (Electron desktop client cert validation) — desktop client only, we ship the server image.
REAL (10), all < 26.10.0 (some >= 2.6/2.7), fixed 26.10.0:
- Strangers (no login): GHSA-7j7m (low; login rate limit bypassed by rotating X-Forwarded-For — reachable, our route keeps the client XFF chain); GHSA-fj9w (high; webhook-trigger body injected into run_command shell — reachable only if a household user built such an automation); GHSA-hmv7 (high; read-only share guest types into owner's SSH session — needs a share link the owner handed out).
- Any household user: GHSA-3q2m (high, cross-user nested automation), GHSA-rgf3 (high, cross-user SFTP session), GHSA-v3vp (high, Cloudflare ACME token in user export — only if admin set Cloudflare DNS ACME), GHSA-r7x4 (medium, Guacamole token for any target; no guacd in our stack), GHSA-wv2p (medium, Vault SSRF), GHSA-6gr3 (low, 2FA bypass — needs the password).
- Admin-config dependent: GHSA-j7j4 (medium, LDAPS no cert check — only if LDAP configured). Worst real: high.
Fix
Smallest: 26.10.0. TARGET: 26.10.5 (newest stable; path 2.8.0 -> 2.9.2 -> 26.10.5). Same main: NO (2 -> 26). Breaking (read release-2.9.0..2.9.2-tag, v26.10.0..v26.10.5): 2.9.0 large API change for plugin system (mobile app >= 1.5.1); 26.10.0 features moved into plugins, calendar versions, TRUSTED_PROXIES added, no downgrade to 2.8, 2.9 must run once first; 26.10.2 compose no longer starts guacd; 26.10.3 sync moved to a plugin, layouts from a plugin; 26.10.5 image variants (default/minimal/full). 2.9.1/2.9.2 fixed OIDC-after-upgrade and a 100 GB/h disk-write bug (do not stop on 2.9.0/2.9.1). Lane: BIG_STEP (two-hop).
Classifier note
Skip advisories whose package/summary is the Desktop/Electron client (frx8, r9gw). The 2.8 -> 26.10 jump is a calendar-version rename, not 24 majors.