Executive brief
electerm is an open-source terminal and file transfer client supporting multiple protocols including SSH and remote file transfer. A path traversal vulnerability in its Zmodem and Trzsz file download handlers allows a malicious remote server to write files outside the user-selected download directory, potentially overwriting critical system files like .bashrc or other sensitive configuration files on the user's computer.
Technical details
The vulnerability is a classic path traversal flaw (CWE-22) in the file download handlers for Zmodem and Trzsz protocols. The vulnerable code in src/app/server/zmodem.js (prepareReceiveFile() at line 736) and src/app/server/trzsz.js (getUniqueFilePath() at line 559 and openSaveFile() callback) directly uses remote-supplied filenames in path.join() without sanitization. An attacker controlling a malicious SSH server or remote shell can craft filenames containing traversal sequences (e.g., ../../.bashrc, ../escaped.txt) to escape the user-selected download directory. When the user initiates a file transfer and accepts the transfer, the file is written to an arbitrary location on the filesystem subject to process permissions. The fix (commit fde153d) sanitizes filenames by removing path traversal sequences, replacing reserved characters, and validating against Windows reserved device names. A patch is available in version 3.11.11 and later.
Affected products
- electerm electerm <= 3.11.0
Timeline
- 2026-07-02: disclosed: Advisory published on GitHub
- 2026-05-25: patched: Security fix committed (fde153d)
- 2026-07-02: other: Fixed in version 3.11.11