CVE-2026-73225: electerm Path Traversal Vulnerability

CVE-2026-73225 Overview

CVE-2026-73225 is a path traversal vulnerability [CWE-22] in electerm, an open-source terminal, SSH, SFTP, Telnet, serial port, RDP, VNC, Spice, and FTP client. Versions prior to 3.15.120 allow a malicious FTP or SFTP server to write attacker-controlled content outside the user-selected download directory. The flaw resides in recursive transfer handling within src/client/components/file-transfer/transfer.jsx, which passes server-supplied file.name and folder.name values to resolve without sanitization. A hostile server can inject ../ sequences or absolute paths to write files anywhere the electerm process has permission.

Critical Impact
A malicious FTP/SFTP server can overwrite arbitrary files on a connecting electerm client, potentially achieving code execution by planting binaries in startup or configuration directories.

Affected Products

electerm versions prior to 3.15.120
electerm desktop client (all supported platforms: Windows, macOS, Linux)
Recursive FTP/SFTP transfer feature in src/client/components/file-transfer/transfer.jsx

Discovery Timeline

2026-08-11 - CVE-2026-73225 published to NVD
2026-08-11 - Last updated in NVD database
Fixed in release - electerm v3.15.120

Technical Details for CVE-2026-73225

Vulnerability Analysis

The vulnerability is a client-side path traversal triggered during recursive directory transfers over FTP or SFTP. When a user initiates a download from a remote server, electerm enumerates remote entries and constructs local destination paths by combining the chosen download directory with server-provided file and folder names. Because these names originate from the remote server, a hostile or compromised server can return entries such as ../../../etc/cron.hourly/payload or absolute paths. The client passes these values directly to resolve, which normalizes them and produces a destination outside the intended directory. This flips the trust model: the FTP/SFTP client, traditionally treated as trusted relative to the server, becomes the victim.

Root Cause

The root cause is missing input validation on remote-supplied names. src/client/components/file-transfer/transfer.jsx invoked resolve on server-controlled file.name and folder.name strings without filtering directory separators or parent-directory references. The patch introduces sanitizeFilename from ../../common/sanitize-filename to strip unsafe characters and traversal sequences before path construction.

Attack Vector

An attacker operates a rogue FTP or SFTP server, or compromises an existing one. When a victim connects with a vulnerable electerm client and initiates a recursive download, the server returns crafted directory listings with traversal payloads in file names. Successful exploitation requires user interaction to initiate the transfer, but does not require authentication on the client side.

text

// Patch excerpt: src/client/components/file-transfer/transfer.jsx
   getFolderFromFilePath
 } from '../sftp/file-read'
 import resolve from '../../common/resolve'
+import sanitizeFilename from '../../common/sanitize-filename'
 import { refsTransfers, refsStatic, refs } from '../common/ref'
 import {
   zipCmd,

Source: GitHub Commit deee11f

The fix imports sanitizeFilename and applies it to remote names before resolving local paths, preventing traversal into unintended directories.

Detection Methods for CVE-2026-73225

Indicators of Compromise

Files written outside the user-selected electerm download directory, particularly to user profile locations, startup folders, or ~/.ssh, following an FTP/SFTP transfer session.
Unexpected file creation timestamps in system-sensitive paths correlated with the electerm process (electerm.exe on Windows, electerm on Linux/macOS).
FTP/SFTP session logs on the server side showing directory listings that contain .. sequences or absolute-path file names.

Detection Strategies

Inventory endpoints running electerm and identify installations at versions below 3.15.120.
Monitor file-write telemetry from the electerm process for writes to paths outside typical user-selected download folders.
Inspect FTP/SFTP network captures for server responses containing file entries with ../, backslashes, or leading slashes.

Monitoring Recommendations

Alert on electerm process activity that writes to autorun locations such as Windows Startup, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Linux ~/.config/autostart, or macOS LaunchAgents.
Track connections from electerm clients to unfamiliar FTP/SFTP servers and correlate with subsequent file-system changes.
Log and review use of the recursive download feature in shared or lab environments where users connect to untrusted servers.

How to Mitigate CVE-2026-73225

Immediate Actions Required

Upgrade all electerm installations to version 3.15.120 or later, as published in the GitHub Release v3.15.120.
Until patched, avoid recursive FTP/SFTP downloads from servers that are not fully trusted.
Review any recent recursive transfers performed by vulnerable clients and audit destination directories for unexpected files.

Patch Information

The fix is included in electerm 3.15.120. The vendor commit deee11f adds sanitizeFilename to src/client/components/file-transfer/transfer.jsx and applies it to remote-supplied file.name and folder.name values before local path resolution. Full details are documented in the GitHub Security Advisory GHSA-6wh4-q387-x93j.

Workarounds

Perform single-file downloads instead of recursive directory transfers when a client cannot be upgraded immediately.
Restrict electerm usage to trusted FTP/SFTP endpoints and remove saved credentials for untrusted hosts.
Run electerm under a least-privilege user account so that any traversal is limited to that account's writable paths.

bash

# Verify installed electerm version and upgrade if below 3.15.120
electerm --version

# macOS example using Homebrew
brew upgrade --cask electerm

# Linux example (AppImage): download 3.15.120 from the vendor release page
curl -LO https://github.com/electerm/electerm/releases/download/v3.15.120/electerm-3.15.120-linux-x86_64.AppImage
chmod +x electerm-3.15.120-linux-x86_64.AppImage