Is CVE-2026-73225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73225 being exploited in the wild.

How severe is CVE-2026-73225?

High severity, with a CVSS score of 8.1, published 11 August 2026.

Which products and versions are affected?

electerm electerm before 3.15.120.

Is there a fix for CVE-2026-73225?

A patch was published on 2026-07-11: Version 3.15.120 released with security fixes for unsafe filename parsing Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73225 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73225?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73225: electerm path traversal in FTP/SFTP file transfer

CVE-2026-73225 · Severity: high · CVSS 8.1 · Published 2026-08-11

electerm is a multi-protocol terminal and file transfer client. A vulnerability in versions prior to 3.15.120 allows a malicious FTP or SFTP server to write files outside the user's intended download directory by crafting specially-named files with path traversal sequences, potentially enabling an attacker to overwrite system files or inject malicious content on the user's computer.

Quick answers

Is CVE-2026-73225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73225 being exploited in the wild.
How severe is CVE-2026-73225?: High severity, with a CVSS score of 8.1, published 11 August 2026.
Which products and versions are affected?: electerm electerm before 3.15.120.
Is there a fix for CVE-2026-73225?: A patch was published on 2026-07-11: Version 3.15.120 released with security fixes for unsafe filename parsing Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73225 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73225?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw in the recursive file transfer implementation (src/client/components/file-transfer/transfer.jsx). The vulnerable code passes server-supplied file.name and folder.name values directly to path resolution functions without sanitization, allowing directory traversal sequences (e.g., "../") to escape the intended download directory. An attacker controlling an FTP or SFTP server can exploit this by responding to download requests with crafted filenames containing traversal patterns. The attack requires no user authentication or special interaction beyond initiating a file transfer from a malicious server. The vulnerability is fixed in version 3.15.120 by parsing and sanitizing unsafe filenames before path resolution.

Affected products

electerm electerm before 3.15.120

Timeline

2026-08-11: disclosed
2026-07-11: patched: Version 3.15.120 released with security fixes for unsafe filename parsing

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.