CVE-2026-49253: electerm Path Traversal Vulnerability

CVE-2026-49253 Overview

CVE-2026-49253 is a path traversal vulnerability [CWE-22] in electerm, an open-source terminal, SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP client. Versions prior to 3.11.11 use remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. A malicious SSH server or remote shell can supply filenames containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer, electerm writes outside the selected download directory and overwrites files accessible to the desktop user.

Critical Impact
A malicious remote shell can overwrite arbitrary files on the client host outside the chosen download directory, potentially modifying shell startup files, SSH configuration, or other sensitive user-owned resources.

Affected Products

electerm versions prior to 3.11.11
src/app/server/zmodem.js — prepareReceiveFile() function
src/app/server/trzsz.js — getUniqueFilePath(), openSaveFile(), and savedFilePaths mapping

Discovery Timeline

2026-08-19 - CVE-2026-49253 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49253

Vulnerability Analysis

The vulnerability resides in electerm's Zmodem and Trzsz receive paths. In src/app/server/zmodem.js, the prepareReceiveFile() function joins the attacker-supplied filename to the user-selected save path using path.join(). In src/app/server/trzsz.js, the getUniqueFilePath() helper, the openSaveFile() callback, and the savedFilePaths mapping construct destination paths without normalizing or validating the remote input.

Because path.join() resolves .. segments, a filename such as ../../.bashrc produces a destination outside the user-selected directory. The write occurs with the privileges of the electerm desktop user, allowing overwrite of any file that user can modify.

Root Cause

The root cause is missing sanitization of remote-controlled filenames prior to path construction. Neither Zmodem nor Trzsz protocol handlers stripped directory separators, rejected traversal sequences, or confined the resolved path to the user-chosen destination directory.

Attack Vector

Exploitation requires user interaction: the victim must accept an incoming Zmodem or Trzsz transfer initiated by a malicious or compromised SSH server or remote shell. Once the transfer is accepted and a download directory is chosen, the server-supplied filename controls the final write location.

javascript

// Fix introduced in electerm 3.11.11 — src/app/common/sanitize-filename.js
// Sanitize a filename for cross-platform file transfers.
//
// Rules applied:
// - Remove control characters (0x00-0x1F)
// - Replace reserved characters: < > : " / \ | ? * with _
// - Remove leading/trailing dots and spaces (Windows restriction)
// - Reject reserved Windows device names: CON, PRN, AUX, NUL, COM1-9, LPT1-9
// - Limit filename length to 255 bytes
// - Fallback to 'unnamed' if result is empty

// eslint-disable-next-line no-control-regex
const ILLEGAL_CHARS = /[<>:"/\\|?\\x00-\\x1f]/g
const LEADING_TRAILING = /^[.\s]+|[.\s]+$/g
const RESERVED_NAMES = /^(CON|PRN|AUX|NUL|COM[1-9]|LPT[1-9])(?:\.|$)/i
const MAX_FILENAME_LENGTH = 255
const REPLACEMENT_CHAR = '_'

Source: GitHub Commit fde153d

Detection Methods for CVE-2026-49253

Indicators of Compromise

Files modified outside the user-selected electerm download directory shortly after a Zmodem or Trzsz session
Unexpected changes to shell startup files such as .bashrc, .zshrc, .profile, or SSH configuration files under ~/.ssh/
electerm process writing to paths containing .. segments in filesystem audit logs
Connections from electerm to untrusted or newly observed SSH endpoints followed by filesystem writes to sensitive user directories

Detection Strategies

Enable filesystem auditing on user home directories to flag writes by electerm processes to paths outside expected download locations.
Correlate electerm network sessions with subsequent modifications to dotfiles or configuration files owned by the desktop user.
Inspect electerm application logs for Zmodem or Trzsz transfer events and compare recorded destination paths against user-selected directories.

Monitoring Recommendations

Track electerm version deployment across endpoints and alert on any host running a version below 3.11.11.
Monitor for outbound SSH connections from workstations to untrusted hosts followed by client-side file writes.
Alert on modifications to high-value user assets such as ~/.bashrc, ~/.ssh/authorized_keys, and ~/.ssh/config.

How to Mitigate CVE-2026-49253

Immediate Actions Required

Upgrade electerm to version 3.11.11 or later on all endpoints where the client is installed.
Restrict use of electerm to trusted SSH endpoints until the upgrade is complete.
Audit user home directories for unexpected modifications to shell startup files and SSH configuration.

Patch Information

The issue is fixed in electerm 3.11.11. The patch introduces src/app/common/sanitize-filename.js, which strips control characters, replaces reserved characters, removes leading and trailing dots and spaces, rejects reserved Windows device names, and enforces a 255-byte filename length limit. See the GitHub Security Advisory GHSA-38j7-23hf-9mhc, the GitHub Release v3.11.11, and the GitHub Commit Details for full remediation details.

Workarounds

Decline Zmodem and Trzsz transfer prompts originating from SSH servers that are not fully trusted.
Run electerm under a dedicated low-privilege user account with limited access to sensitive configuration files.
Choose download directories on isolated volumes that do not contain sensitive dotfiles or credentials.

bash

# Verify the installed electerm version and upgrade if below 3.11.11
electerm --version

# Download the fixed release from the official GitHub release page
# https://github.com/electerm/electerm/releases/tag/v3.11.11