CVE-2026-73225

Received Received - Intake

Path Traversal in Electerm FTP Client

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-11

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73225

EUVD

EUVD-2026-56916

Affected Vendors & Products

Vendor	Product	Version / Range
electerm	electerm	to 3.15.120 (exc)
electerm	electerm	to 3.15.110 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in the Electerm application. It occurs during FTP or SFTP file transfers when the application fails to properly sanitize filenames provided by a malicious server. The vulnerability allows an attacker to write files outside the intended download directory by including path traversal sequences like ../../ in filenames.

Detection Guidance

Check if your Electerm version is below 3.15.120 by running 'electerm --version' or checking installed packages. Monitor network traffic for suspicious FTP/SFTP file transfers or unexpected file writes outside intended directories.

Impact Analysis

An attacker could exploit this to write arbitrary files to your system outside the download directory. This could lead to code execution if malicious files are placed in sensitive locations. It may also allow overwriting important system files or configuration files.

Compliance Impact

This vulnerability could lead to unauthorized file writes which may violate data integrity and confidentiality requirements in GDPR and HIPAA. It could result in unauthorized access to sensitive data or system compromise, potentially leading to compliance violations.

Mitigation Strategies

Upgrade Electerm to version 3.15.120 or later immediately. Avoid using Electerm to connect to untrusted FTP/SFTP servers until patched. Review file system for unauthorized writes if potentially affected.

Hi! I’m here to help you understand CVE-2026-73225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70