Executive brief
electerm is a terminal and file transfer client that supports SSH, SFTP, and multiple other protocols. A malicious SFTP server can trick electerm into writing files outside the intended temporary directory by supplying specially crafted filenames that bypass path validation, potentially allowing arbitrary file writes to the user's system.
Technical details
This is a path traversal vulnerability in electerm's SFTP file handling. The root cause is in the editWithSystemEditor function in src/client/components/sftp/file-item.jsx, where filenames supplied by the SFTP server are directly interpolated into path.resolve() without sanitization. An attacker controlling a malicious SFTP server can craft filenames with path traversal sequences (e.g., "../../../") to bypass the temporary directory boundary. When the user edits a file with a custom editor, the malicious filename allows writing or overwriting arbitrary files on the client system. The attack requires network interaction with a malicious SFTP server and user interaction (selecting a file to edit). The vulnerability is fixed in version 3.15.120 by parsing and sanitizing unsafe filenames before path resolution.
Affected products
- electerm electerm prior to 3.15.120
Timeline
- 2026-08-11: disclosed
- 2026-07-11: patched: Version 3.15.120 released with fix
- 2026-08-11: other: Published on NVD