Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T15:17:06.747Z",
  "pubdate": "2026-08-19T15:17:06.747Z",
  "executiveSummary": "A path traversal vulnerability exists in the electerm terminal, SSH, SFTP, telnet, serialport, RDP, VNC, Spice, and FTP client prior to version 3.11.11. The vulnerability arises due to the application's handling of remote-supplied filenames during Zmodem and Trzsz file transfers, where untrusted filenames are concatenated directly using path.join() without adequate sanitization. This flaw allows a malicious SSH server or compromised remote shell to supply specially crafted filenames containing directory traversal sequences such as ../escaped.txt or ../../.bashrc. When a victim accepts a file transfer and selects a download destination, electerm resolves the path outside the intended directory, resulting in arbitrary file write capabilities. The potential impact includes the unauthorized modification or overwriting of sensitive configuration files accessible to the local desktop user, leading to potential data tampering or availability degradation. Exploitation requires user interaction to initiate and accept the file transfer from a malicious or compromised remote endpoint.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and sanitization of remote-supplied filenames during Zmodem and Trzsz file transfer operations within electerm prior to version 3.11.11. Specifically, the vulnerable components include src/app/server/zmodem.js, where the prepareReceiveFile() function directly joins the remote-supplied filename to the user-selected save path using path.join(), and src/app/server/trzsz.js, where getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destination file paths without validating or neutralizing directory traversal sequences.\nDuring an attack flow, a malicious SSH server or a compromised remote shell initiates a file transfer using the Zmodem or Trzsz protocol. The remote entity provides a specially crafted payload within the filename parameter containing relative path traversal components, such as ../escaped.txt or ../../.bashrc. When the client user accepts the transfer and designates a target download directory, the vulnerable functions combine the base download directory with the malicious filename. Because path.join() resolves these relative traversal components, the resulting file path escapes the intended download directory boundary.\nConsequently, electerm writes the transferred file data to locations outside the designated directory, granting the attacker the ability to overwrite arbitrary files accessible to the privileges of the local user running the electerm desktop application. The network exposure is tied to the SSH or remote terminal session established by the user. No special authentication or privilege requirements are needed by the attacker beyond controlling the remote server or shell interacting with the client during the Zmodem or Trzsz file transfer session. Post-exploitation impact depends on the files overwritten, which may include sensitive user configuration files or system scripts."
}