Executive brief
electerm is a multi-protocol terminal client that supports RDP connections for remote desktop access. A malicious RDP server can exploit a path traversal vulnerability to write files outside the designated download directory, potentially allowing an attacker to place malicious files on a user's system or overwrite legitimate files during a seemingly normal file transfer operation.
Technical details
The vulnerability is a path traversal flaw in the RDP clipboard download functionality within src/client/components/rdp/file-transfer.js. The vulnerable code passes the server-controlled filename (fileInfo.name) directly to osResolve without sanitization, allowing an attacker-controlled RDP server to inject path traversal sequences (e.g., "../") to write files outside the intended save directory. The attack requires an active RDP connection to the malicious server; no prior authentication or user interaction beyond initiating the connection is needed. An attacker can achieve arbitrary file write on the victim's system with the privileges of the electerm process. The vulnerability was fixed in version 3.15.120 by implementing proper filename sanitization.
Affected products
- electerm electerm before 3.15.120
Timeline
- 2026-08-11: disclosed
- 2026-07-11: patched: Version 3.15.120 released