CVE-2026-73227: Electerm Path Traversal Vulnerability

CVE-2026-73227 Overview

CVE-2026-73227 is a path traversal vulnerability [CWE-22] in electerm, an open-source terminal client supporting SSH, SFTP, Telnet, SerialPort, RDP, VNC, Spice, and FTP protocols. Versions prior to 3.15.120 allow a malicious Remote Desktop Protocol (RDP) server to write attacker-controlled content outside the user-selected save directory. The flaw resides in src/client/components/rdp/file-transfer.js, where the RDP clipboard download path passes the server-controlled CLIPRDR fileInfo.name value to osResolve without sanitization. An attacker who convinces a user to connect to a malicious RDP server can achieve arbitrary file write on the client host.

Critical Impact
A malicious RDP server can write files to arbitrary locations on the electerm client filesystem, enabling code execution paths, configuration tampering, and integrity compromise of the victim host.

Affected Products

electerm versions prior to 3.15.120
Component: src/client/components/rdp/file-transfer.js (RDP clipboard file transfer handler)
Deployments where users connect to untrusted or attacker-controlled RDP servers

Discovery Timeline

2026-08-11 - CVE-2026-73227 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database
Fix released in electerm version 3.15.120 via GitHub Security Advisory GHSA-gm6q-5vpx-3mwf

Technical Details for CVE-2026-73227

Vulnerability Analysis

The RDP clipboard file transfer feature in electerm handles CLIPRDR (Clipboard Virtual Channel Extension) messages from the remote server. When the server offers a file via clipboard, electerm receives a fileInfo object containing a server-controlled name field. The client uses this name directly to construct the local write path via osResolve. The function resolves relative path segments such as ..\..\ or absolute paths, allowing the resulting write target to escape the user-selected save directory. Because file paths are trusted as directory entries rather than validated filenames, the server dictates where content lands on disk.

Root Cause

The root cause is missing input sanitization on untrusted network input. The CLIPRDR filename is treated as a benign string and passed unchanged to path resolution logic. Path resolvers honor traversal sequences and drive letters, so a filename like ..\..\Users\victim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\payload.lnk resolves outside the intended download folder. The patch introduces a sanitizeFilename helper imported from ../../common/sanitize-filename to strip path components before use.

Attack Vector

Exploitation requires the victim to initiate an RDP session to a server the attacker controls. Once connected, the server sends a crafted CLIPRDR file descriptor with a malicious fileInfo.name. If the user accepts the clipboard transfer, electerm writes the attacker's content to the traversed path. Impact scales with process privileges and can include planting startup executables, overwriting user configuration, or dropping shortcut files for later execution.

javascript

// Security patch in src/client/components/rdp/file-transfer.js
 import { getLocalFileInfo } from '../sftp/file-read'
 import { osResolve } from '../../common/resolve'
 import { filesize } from 'filesize'
+import sanitizeFilename from '../../common/sanitize-filename'

 const LOG_PREFIX = '[RDP-FILE-TRANSFER]'

Source: GitHub Commit 451bf30

Detection Methods for CVE-2026-73227

Indicators of Compromise

Files written outside the user-configured electerm RDP download directory following an RDP session
New or modified files in sensitive locations such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ timestamped shortly after an RDP connection
electerm process creating files with parent path components resolving through .. sequences
RDP sessions to unknown or newly registered external hosts followed by unexpected file creation events

Detection Strategies

Inventory installed electerm versions across engineering and administrator workstations and flag any release below 3.15.120
Monitor file creation events where the electerm process writes outside its documented download directory
Correlate outbound RDP connections (TCP/3389 or configured RDP ports) with subsequent file writes to autorun or profile locations
Alert on filename fields containing path traversal sequences captured in endpoint telemetry

Monitoring Recommendations

Enable filesystem auditing on user profile directories, startup folders, and application data paths for processes spawned by electerm
Log RDP client connection metadata including destination host, session duration, and clipboard channel negotiation
Ingest endpoint file-write telemetry into a central data lake to build baselines for electerm write locations
Track integrity of user-writable autorun locations with periodic hash comparisons

How to Mitigate CVE-2026-73227

Immediate Actions Required

Upgrade all electerm installations to version 3.15.120 or later without delay
Restrict RDP connections from electerm clients to trusted, inventoried servers only
Audit user workstations for unexpected files written by electerm since the last known-good state
Inform users of the risk of connecting to untrusted RDP endpoints and the clipboard file transfer attack surface

Patch Information

The fix is available in electerm release v3.15.120. The patch introduces a sanitizeFilename utility that strips directory components from the server-supplied fileInfo.name before it reaches osResolve. Details are documented in GitHub Security Advisory GHSA-gm6q-5vpx-3mwf and the source change in commit 451bf30.

Workarounds

Disable clipboard sharing in electerm RDP session profiles until the upgrade is applied
Decline any RDP clipboard file transfer prompts originating from untrusted servers
Run electerm under a low-privilege user account to reduce blast radius of arbitrary writes
Use application allowlisting to prevent execution of files dropped into autorun locations

bash

# Verify installed electerm version and upgrade guidance
electerm --version

# Fixed version required
# 3.15.120 or later

# Download the patched release
# https://github.com/electerm/electerm/releases/tag/v3.15.120