CVE-2026-73227 in Electerm
Summary
by MITRE • 08/11/2026
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The electerm terminal client presents a critical directory traversal vulnerability in its RDP file transfer functionality that affects versions prior to 3.15.120. This flaw resides in the src/client/components/rdp/file-transfer.js component where the application processes clipboard data during RDP sessions. The vulnerability stems from insufficient input validation and sanitization of filenames received from remote RDP servers, creating a path traversal condition that allows malicious actors to write files outside of the intended save directory. When an attacker controls an RDP server and manipulates clipboard content, they can inject malicious filenames containing directory traversal sequences such as ../ or ..\ that bypass normal file system restrictions. The specific technical flaw occurs because the application directly passes the unvalidated fileInfo.name property from CLIPRDR protocol messages to the osResolve function without any sanitization or path validation checks, which is a classic example of inadequate input sanitization and improper access control in file system operations.
The operational impact of this vulnerability extends beyond simple unauthorized file creation as it enables potential remote code execution and system compromise through various attack vectors. An attacker who gains control of an RDP server can leverage this flaw to write malicious files to arbitrary locations on the victim's system, potentially including system directories, configuration files, or even executable payloads that could be triggered during normal system operations. This vulnerability directly relates to CWE-22 Path Traversal and CWE-73 Improper Neutralization of Special Elements in Output Used by a Downstream Component, both of which are fundamental security weaknesses that can lead to severe consequences in client applications handling remote file transfers. The attack surface is particularly concerning given that RDP servers are commonly targeted in enterprise environments, and the vulnerability could be exploited during routine remote desktop sessions where users might not suspect malicious activity in clipboard operations.
Mitigation strategies for this vulnerability should focus on implementing comprehensive input validation and path sanitization measures within the affected component. The fix implemented in version 3.15.120 addresses this by properly sanitizing the filename parameter before passing it to file system operations, ensuring that directory traversal sequences are removed or neutralized. Organizations should immediately update to electerm version 3.15.120 or later to protect against exploitation of this vulnerability. Security measures should also include monitoring for unusual file creation patterns and implementing network-level controls that restrict RDP server access to trusted sources only. From an ATT&CK framework perspective, this vulnerability maps to T1071.004 Application Layer Protocol: Remote Desktop Protocol and T1566 Phishing, as attackers could use compromised RDP servers to deliver malicious payloads through clipboard injection techniques. Additionally, the vulnerability aligns with T1021.001 Remote Services: Remote Desktop Protocol in terms of lateral movement and system compromise potential, particularly when combined with other attack techniques that leverage remote desktop sessions for persistent access.
The broader implications of this vulnerability highlight the importance of secure coding practices in client applications that handle data from untrusted sources. The flaw demonstrates how seemingly innocuous clipboard functionality can become a vector for serious security breaches when proper input validation is omitted. This issue underscores the necessity of implementing defense-in-depth strategies, including proper file system access controls, regular security audits of third-party components, and comprehensive threat modeling that considers all potential attack vectors in remote desktop protocols. Organizations should also consider implementing additional monitoring and logging mechanisms around file system operations to detect anomalous behavior that might indicate exploitation attempts. The vulnerability serves as a reminder that even open-source applications require continuous security assessment and timely patch management to protect against evolving threats in remote access environments.