Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T19:18:51.880Z",
  "pubdate": "2026-08-11T19:18:51.880Z",
  "executiveSummary": "Electerm prior to version 3.15.120 suffers from a path traversal vulnerability that enables a malicious SFTP server to write attacker-controlled content outside of the intended temporary directory.\nThis vulnerability is classified as an arbitrary file write issue stemming from improper input sanitization during filename handling in the SFTP module.\nThe impact includes potential unauthorized file overwrite or creation on the host system running the client, which could lead to further system compromise depending on where the files are written and their contents.\nThe affected product is electerm across versions prior to 3.15.120, impacting users interacting with untrusted or compromised SFTP servers.\nAttackers require a malicious or compromised SFTP server capable of responding to client requests with specially crafted file paths designed to trigger directory traversal.\nNo complex authentication bypass is strictly required beyond establishing an SFTP session with the attacker-controlled server and initiating file editing operations.",
  "technicalDetails": "The vulnerability resides in the editWithSystemEditor function located within src/client/components/sftp/file-item.jsx in electerm prior to version 3.15.120.\nThe root cause of the vulnerability is the unsafe interpolation of server-controlled filenames directly into the path.resolve function without prior sanitization or validation.\nDuring an SFTP file editing operation, the application requests file data from the remote server and utilizes the filename provided by the server to construct the local temporary file path.\nBecause the server-controlled filename is not adequately sanitized, an attacker can supply directory traversal sequences such as relative path components (e.g., ../) within the filename parameter.\nWhen path.resolve processes these traversal sequences combined with the base temporary directory path, the resulting absolute path resolves outside of the intended temporary directory boundary.\nThis allows the malicious SFTP server to dictate the destination path of the file being written to the local filesystem.\nThe attack flow proceeds as follows: 1. The user connects to a malicious SFTP server using electerm. 2. The user attempts to edit a file via the client interface. 3. The malicious server responds with a filename containing directory traversal sequences. 4. The vulnerable editWithSystemEditor function processes the unsanitized filename via path.resolve. 5. The application writes attacker-controlled payload content to the resolved path outside the temporary directory.\nThe affected component is the file handling and system editor integration logic within the client-side SFTP interface of electerm.\nAffected software versions include all electerm builds prior to 3.15.120."
}