Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-11T19:18:52.460Z",
  "pubdate": "2026-08-11T19:18:52.460Z",
  "executiveSummary": "An arbitrary file write vulnerability exists within the electerm terminal, SSH, SFTP, telnet, serial port, RDP, VNC, Spice, and FTP client prior to version 3.15.120.\nThe flaw specifically resides in the RDP clipboard download handler, allowing a malicious RDP server to write attacker-controlled content to arbitrary locations outside the designated save directory.\nThe vulnerability poses significant risk implications, potentially enabling remote code execution or system compromise if an attacker overwrites critical application or system files during a file transfer or clipboard operation.\nTo successfully exploit this issue, an attacker must control or compromise a remote RDP server to which the victim connects, and induce the user to perform clipboard download actions.\nNo specific authentication or elevated privilege requirements are imposed beyond the ability to establish an RDP session and supply malicious filename metadata through the protocol stream.\nRemediation requires updating electerm to version 3.15.120 or later, where input sanitization has been implemented to properly validate file paths.",
  "technicalDetails": "The root cause of the vulnerability stems from improper input validation and the lack of path sanitization within the RDP file transfer logic.\nSpecifically, the vulnerable component is located in src/client/components/rdp/file-transfer.js, which handles RDP clipboard download operations.\nDuring a clipboard file transfer sequence, the server provides a filename via the CLIPRDR channel encapsulated in the fileInfo.name variable.\nThe application directly passes this server-controlled fileInfo.name parameter to the osResolve function without performing adequate path traversal checks or sanitization.\nBecause osResolve processes relative path sequences such as dot-dot-slash (../) without restriction, an attacker can manipulate the filename attribute to traverse upward through the directory hierarchy from the selected save directory.\nThe attack flow proceeds as follows: 1. A user initiates an RDP connection to a malicious or compromised remote RDP server. 2. The malicious server advertises or initiates a clipboard file transfer operation. 3. The server supplies a crafted fileInfo.name payload containing path traversal sequences (e.g., ../../../evil.sh). 4. The vulnerable electerm client receives the payload and passes it directly to osResolve. 5. The application resolves the target path outside the intended boundary and writes the attacker-supplied payload content to the arbitrary destination on the host file system.\nThis behavior affects all electerm versions prior to 3.15.120.\nNetwork exposure is inherent to the RDP protocol implementation within the client application.\nPost-exploitation impact depends on the write permissions of the executing user process and the targeted file location, potentially allowing the modification of startup scripts, configuration files, or application binaries."
}