CVE-2026-73223: Electerm Path Traversal Vulnerability

CVE-2026-73223 Overview

CVE-2026-73223 is a path traversal vulnerability [CWE-22] in electerm, an open-source terminal, SSH, SFTP, telnet, serial port, RDP, VNC, Spice, and FTP client. Versions prior to 3.15.120 allow a malicious SFTP server to write attacker-controlled content outside the intended temporary directory. The flaw resides in the editWithSystemEditor function in src/client/components/sftp/file-item.jsx, which interpolates a server-controlled filename into path.resolve without sanitization. A user connecting to a hostile SFTP server and choosing to edit a remote file triggers arbitrary file write on the client system.

Critical Impact
A malicious SFTP server can write attacker-controlled files to arbitrary locations on the connecting client, enabling code execution or configuration tampering when a user opens a remote file for editing.

Affected Products

electerm versions prior to 3.15.120
The editWithSystemEditor component in src/client/components/sftp/file-item.jsx
Client platforms (Windows, macOS, Linux) running vulnerable electerm builds

Discovery Timeline

2026-08-11 - CVE-2026-73223 published to NVD
2026-08-12 - Last updated in NVD database
Version 3.15.120 - electerm releases patched build addressing the issue

Technical Details for CVE-2026-73223

Vulnerability Analysis

The vulnerability stems from unsafe handling of a filename supplied by a remote SFTP server. When a user chooses to edit a remote file with a system editor, electerm downloads the file to a local temporary directory and opens it. The client trusts the name field returned by the SFTP server and passes it directly to path.resolve when constructing the destination path.

Because path.resolve treats absolute paths and .. sequences as valid navigation, an attacker-controlled filename such as ../../../../etc/cron.d/payload or an absolute Windows path escapes the intended temporary directory. The client then writes attacker-supplied content to that location using the privileges of the electerm user.

The attack requires user interaction: the victim must connect to a hostile SFTP server and initiate an edit action on a crafted file. The impact is high on integrity and availability but does not directly disclose confidential data.

Root Cause

The root cause is missing input sanitization on a server-controlled filename before path construction. The patched code in commit 32ea29365762b3451b1f2fcc0ef78104384db282 imports and applies a sanitizeFilename helper along with a user-facing message warning when unsafe filenames are detected.

Attack Vector

Exploitation requires a victim to connect to an attacker-controlled SFTP server and perform an edit-with-system-editor action on a file whose name contains traversal sequences or absolute path components. Once triggered, the client writes the downloaded content outside the intended temporary directory, enabling overwrite of startup scripts, configuration files, or user-writable binaries.

text

 import sanitizeFilename from '../../common/sanitize-filename'
 import { refsStatic, refs, filesRef } from '../common/ref'
 import iconsMap from '../sys-menu/icons-map'
+import message from '../common/message'
 
 const e = window.translate

// Source: https://github.com/electerm/electerm/commit/32ea29365762b3451b1f2fcc0ef78104384db282
// The patch introduces sanitizeFilename usage and a message helper in file-item.jsx
// to reject or normalize traversal sequences in server-supplied filenames.

Detection Methods for CVE-2026-73223

Indicators of Compromise

Unexpected files appearing outside the electerm temporary download directory shortly after an SFTP editing session
SFTP session logs showing filenames containing .., forward or backward slashes, or absolute path prefixes
New or modified files in sensitive paths such as ~/.ssh, ~/.bashrc, %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup, or /etc/cron.d

Detection Strategies

Inventory endpoints for electerm installations and flag any version prior to 3.15.120
Monitor file creation events by the electerm process outside its expected working directories
Alert on outbound SFTP connections from user workstations to untrusted or newly observed hosts

Monitoring Recommendations

Enable process and file-write telemetry for electerm across managed endpoints
Correlate electerm write events with the destination path to identify writes outside the temp directory
Track network connections initiated by electerm to non-corporate SFTP endpoints

How to Mitigate CVE-2026-73223

Immediate Actions Required

Upgrade all electerm installations to version 3.15.120 or later
Advise users to avoid connecting to untrusted SFTP servers and to not use the edit-with-system-editor feature on remote files from unknown sources
Audit endpoints for any unexpected file modifications following recent electerm SFTP sessions

Patch Information

The fix is available in electerm version 3.15.120. Commit 32ea29365762b3451b1f2fcc0ef78104384db282 introduces sanitization of server-controlled filenames in src/client/components/sftp/file-item.jsx via a sanitizeFilename helper. See the GitHub Security Advisory GHSA-4cgc-4vgf-q55c and electerm Release v3.15.120 for full details.

Workarounds

Refrain from using the edit-with-system-editor function against remote files until the upgrade is applied
Restrict SFTP connections from electerm to trusted, controlled servers only
Run electerm under a least-privileged user account to limit the impact of arbitrary file writes

bash

# Verify the installed electerm version and upgrade if below 3.15.120
electerm --version

# Download the fixed release from the official project page
# https://github.com/electerm/electerm/releases/tag/v3.15.120