CVE-2026-73223 in Electerm
Summary
by MITRE • 08/11/2026
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The electerm terminal client presents a critical security vulnerability in its SFTP implementation that enables remote code execution through malicious server interactions. This flaw exists in versions prior to 3.15.120 where the application fails to properly sanitize user-controlled input during file operations. The vulnerability stems from improper handling of server-controlled filenames within the editWithSystemEditor function located in src/client/components/sftp/file-item.jsx. When a malicious SFTP server provides a filename containing directory traversal sequences or absolute paths, the application directly interpolates this unvalidated input into path.resolve() calls without appropriate sanitization measures.
The technical exploitation of this vulnerability occurs when an attacker controls an SFTP server that communicates with a victim using electerm. The malicious server can craft filenames that contain sequences such as ../ or absolute paths like /tmp/../../../etc/passwd, which bypass the intended temporary directory boundaries. This allows attackers to write files outside of the designated temporary storage area, potentially overwriting system files or creating malicious content in critical directories. The vulnerability represents a classic path traversal attack vector that has been classified under CWE-22 - Improper Limitation of a Pathname to a Restricted Directory.
From an operational perspective, this vulnerability poses significant risks to users who maintain connections with untrusted SFTP servers. The impact extends beyond simple file corruption as attackers can leverage this weakness to execute arbitrary code on the victim's system through the system editor that electerm invokes. The attack requires minimal privileges since it operates within the context of the user running electerm, but the consequences can be severe depending on the system configuration and user permissions. This vulnerability aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: PowerShell, as attackers could use this to establish persistence or escalate privileges through shell command execution.
The fix implemented in version 3.15.120 addresses this weakness by introducing proper input validation and sanitization of filenames before they are processed by path.resolve(). This remediation follows security best practices for preventing directory traversal attacks and aligns with industry standards for secure file handling. Organizations using electerm should immediately update to version 3.15.120 or later to mitigate this risk, as the vulnerability could enable attackers to gain unauthorized access to system resources and potentially establish persistent backdoors through crafted SFTP server interactions. The mitigation strategy emphasizes the importance of input validation in client-side applications that handle network-provided data, particularly when operating with elevated privileges or system-level access through integrated editors.