Executive brief
electerm is a multi-protocol terminal and file transfer client. A vulnerability in versions prior to 3.15.120 allows a malicious FTP or SFTP server to write files outside the user's intended download directory by crafting specially-named files with path traversal sequences, potentially enabling an attacker to overwrite system files or inject malicious content on the user's computer.
Technical details
The vulnerability is a path traversal flaw in the recursive file transfer implementation (src/client/components/file-transfer/transfer.jsx). The vulnerable code passes server-supplied file.name and folder.name values directly to path resolution functions without sanitization, allowing directory traversal sequences (e.g., "../") to escape the intended download directory. An attacker controlling an FTP or SFTP server can exploit this by responding to download requests with crafted filenames containing traversal patterns. The attack requires no user authentication or special interaction beyond initiating a file transfer from a malicious server. The vulnerability is fixed in version 3.15.120 by parsing and sanitizing unsafe filenames before path resolution.
Affected products
- electerm electerm before 3.15.120
Timeline
- 2026-08-11: disclosed
- 2026-07-11: patched: Version 3.15.120 released with security fixes for unsafe filename parsing