# CVE-2026-73227: electerm unsafe RDP filename in clipboard download

Source: https://junglewise.ai/threats/cve-2026-73227-electerm-unsafe-rdp-filename-in-clipboard-download  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73227 · Severity: high · CVSS 8.1 · Published 2026-08-11

electerm is a multi-protocol terminal client that supports RDP connections for remote desktop access. A malicious RDP server can exploit a path traversal vulnerability to write files outside the designated download directory, potentially allowing an attacker to place malicious files on a user's system or overwrite legitimate files during a seemingly normal file transfer operation.

## Quick answers

**Is CVE-2026-73227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73227 being exploited in the wild.

**How severe is CVE-2026-73227?** High severity, with a CVSS score of 8.1, published 11 August 2026.

**Which products and versions are affected?** electerm electerm before 3.15.120.

**Is there a fix for CVE-2026-73227?** A patch was published on 2026-07-11: Version 3.15.120 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73227 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73227?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the RDP clipboard download functionality within src/client/components/rdp/file-transfer.js. The vulnerable code passes the server-controlled filename (fileInfo.name) directly to osResolve without sanitization, allowing an attacker-controlled RDP server to inject path traversal sequences (e.g., "../") to write files outside the intended save directory. The attack requires an active RDP connection to the malicious server; no prior authentication or user interaction beyond initiating the connection is needed. An attacker can achieve arbitrary file write on the victim's system with the privileges of the electerm process. The vulnerability was fixed in version 3.15.120 by implementing proper filename sanitization.

## Affected products

- electerm electerm before 3.15.120

## Timeline

- 2026-08-11: disclosed
- 2026-07-11: patched: Version 3.15.120 released

## References

- [https://github.com/electerm/electerm/commit/451bf3000672c00b0c3b148fbf3c148c205ce350](https://github.com/electerm/electerm/commit/451bf3000672c00b0c3b148fbf3c148c205ce350)
- [https://github.com/electerm/electerm/releases/tag/v3.15.120](https://github.com/electerm/electerm/releases/tag/v3.15.120)