CVE-2026-73224 in Electerm
Summary
by MITRE • 08/11/2026
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The electerm terminal client presents a critical command injection vulnerability that affects versions prior to 315.120, specifically within its SFTP and FTP functionality. This flaw resides in the file information modal component where the application processes folder names returned by remote servers during size calculations. The vulnerability stems from improper input sanitization when constructing shell commands, creating a path for malicious actors to execute arbitrary code on affected systems.
The technical implementation of this vulnerability occurs in the calcLocal function located at src/client/components/sftp/file-info-modal.jsx, where the application constructs a shell command using the du -sh utility. When users interact with folder properties and trigger size calculations, the system directly incorporates server-controlled folder names into the shell command without proper escaping or sanitization. This creates a classic command injection scenario where malicious folder names containing shell metacharacters can be executed with the privileges of the affected user.
The operational impact of this vulnerability is significant as it allows remote attackers to execute arbitrary commands on systems running vulnerable versions of electerm. An attacker controlling an FTP or SFTP server can craft specially named folders that, when processed by the client application, result in command execution. This attack vector requires user interaction through the Properties and Calculate Size functionality, making it a user-initiated privilege escalation vulnerability rather than a fully automated attack.
The vulnerability aligns with CWE-78, which specifically addresses improper neutralization of special elements used in OS commands, and follows patterns consistent with the ATT&CK technique T1059.004 for command and scripting interpreter. This classification indicates that the attack leverages legitimate system utilities while exploiting trust relationships between the client application and remote servers.
Mitigation strategies include immediate upgrading to electerm version 3.15.120 or later, where the vulnerability has been patched through proper input sanitization. Organizations should also implement network segmentation to limit exposure of vulnerable systems, disable unnecessary file transfer protocols when possible, and monitor for suspicious folder names in file transfer activities. Additionally, security awareness training for users can help prevent accidental interaction with malicious server responses during file operations.
The patch implementation addresses the root cause by properly escaping single quotes around user-controlled input before incorporating it into shell commands, following established best practices for command injection prevention. This fix ensures that any special characters within folder names are treated as literal characters rather than shell metacharacters, eliminating the attack surface for malicious command execution.