Executive brief
electerm is an open-source terminal and file transfer client used to manage remote systems via SSH, SFTP, FTP, and other protocols. A malicious FTP or SFTP server can execute arbitrary commands on a user's system when the user downloads a crafted folder, views its properties, and selects "Calculate Size"—allowing attackers to gain code execution with the privileges of the user running electerm.
Technical details
The vulnerability is a shell injection flaw in the file-info-modal.jsx component's calcLocal function. When calculating folder sizes, the application constructs a shell command using the server-controlled folder name without properly escaping special characters, particularly single quotes. An attacker controlling an FTP or SFTP server can craft a folder name containing shell metacharacters to break out of the du -sh command and inject arbitrary commands. The attack requires user interaction (downloading the folder and invoking the Properties/Calculate Size function) but no authentication. The vulnerability was fixed in version 3.15.120 by safely parsing and escaping the filename before constructing the shell command.
Affected products
- electerm electerm before 3.15.120
Timeline
- 2026-08-11: disclosed
- 2026-07-11: patched: version 3.15.120 released