Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T19:18:52.177Z",
  "pubdate": "2026-08-11T19:18:52.177Z",
  "executiveSummary": "Electerm prior to version 3.15.120 suffers from an insufficient input sanitization vulnerability during recursive file transfer operations. Specifically, the application improperly handles server-supplied directory and file identifiers when processing downloads from remote endpoints. This security flaw allows a malicious FTP or SFTP server to execute arbitrary path traversal, enabling the writing of attacker-controlled content outside the intended local download directory.\nThe impact of this vulnerability includes unauthorized file system write access within the context of the user running the electerm client. An attacker controlling a malicious remote server can leverage this capability to overwrite critical configuration files, drop executable payloads into startup directories, or compromise local data integrity upon initiating a recursive download or synchronization operation.\nAffected systems include all deployments of electerm utilizing client versions prior to 3.15.120. Exploitation requires user interaction, specifically connecting to a malicious or compromised FTP/SFTP server and initiating a recursive transfer operation. No specialized authentication or high-level privileges are required on the client side, as the malicious behavior is triggered entirely by the remote server responding with manipulated file and folder names.",
  "technicalDetails": "The root cause of the vulnerability resides in src/client/components/file-transfer/transfer.jsx within the electerm codebase. During recursive file and folder transfers, the application processes server-supplied metadata, specifically utilizing file.name and folder.name attributes. These values are directly passed into path resolution routines (resolve) without undergoing rigorous sanitization, canonicalization, or validation checks to ensure the resulting paths remain confined within the designated download root.\nThe attack flow begins when a client establishes a connection with a malicious FTP or SFTP server using electerm. The user initiates a recursive download of a directory structure. In response to the transfer request, the malicious server returns crafted directory or file names containing path traversal sequences (such as directory traversal characters like dot-dot-slash). Because the vulnerable component in transfer.jsx fails to sanitize these strings before resolving them against the local file system destination, the path resolution mechanism computes an absolute or relative path that escapes the intended sandbox directory.\nAs the recursive transfer iterates through the payload provided by the remote server, electerm attempts to write incoming data streams to the calculated traversal paths. This results in arbitrary file write capabilities on the host operating system, limited only by the file system permissions granted to the user executing the electerm process. Network exposure is inherent to the remote file transfer protocols (FTP, SFTP) supported by the client application. The vulnerability requires no pre-existing authentication bypass or complex privilege escalation primitives; it relies purely on the implicit trust the client places in the metadata returned by the remote server during a file transfer session."
}