CVE-2026-73224

Received Received - Intake

Command Injection in Electerm via Malicious FTP/SFTP Server

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73224

EUVD

EUVD-2026-56911

Affected Vendors & Products

Vendor	Product	Version / Range
electerm	electerm	to 3.15.120 (exc)
electerm	electerm	to 3.15.110 (inc)
electerm	electerm	3.15.120

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-73224 is a command injection vulnerability in Electerm versions 3.15.110 and earlier. It occurs in the 'Calculate Size' feature which uses an unsanitized folder name to construct a shell command. A malicious SFTP/FTP server can exploit this by providing a directory name with shell metacharacters. When a user downloads the folder and uses 'Calculate Size', the attacker's payload executes arbitrary commands with the user's privileges.

Detection Guidance

To detect this vulnerability, check if your Electerm version is 3.15.110 or earlier. Run 'electerm --version' in your terminal to verify. If the version is vulnerable, inspect network traffic for suspicious SFTP/FTP connections where folder names contain unusual characters like single quotes or shell metacharacters.

Impact Analysis

If you use Electerm versions 3.15.110 or earlier, an attacker could gain control over your system by tricking you into downloading a malicious folder and using the 'Calculate Size' feature. This could lead to data theft, system compromise, or further network attacks, all under your user privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using affected Electerm versions may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Immediately update Electerm to version 3.15.120 or later. If updating is not possible, avoid using the 'Calculate Size' feature for downloaded folders from untrusted SFTP/FTP servers. Disable automatic folder downloads from unknown sources to reduce exposure.

Hi! I’m here to help you understand CVE-2026-73224. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70