What is the CVSS score of CVE-2026-49253?

CVE-2026-49253 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of electerm are affected by CVE-2026-49253?

electerm, an SSH client used for remote system administration, contains a path traversal vulnerability allowing attackers to overwrite arbitrary files on user systems; no public exploit identified at…. A patch is available.

How to fix or mitigate CVE-2026-49253?

Within 24 hours: Identify all users and systems running electerm within your environment; consult your software inventory or endpoint management tools to locate installations. Within 7 days: Apply the available vendor patch per the official electerm advisory; confirm patch deployment across all identified instances. Within 30 days: Conduct verification testing on file transfer functionality in patched versions and review logs for suspicious file transfer activity in the 24 hours prior to patch application.

electerm CVE-2026-49253

EUVD-2026-62421 HIGH

Path Traversal (CWE-22)

2026-07-02 https://github.com/electerm/electerm

GHSA-38j7-23hf-9mhc

Path Traversal

7.1

CVSS 3.1 · Vendor: https://github.com/electerm/electerm

Severity by source

Vendor (https://github.com/electerm/electerm) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Remote malicious server needs no client-side privileges (PR:N) but the victim must accept the transfer (UI:R); arbitrary file overwrite gives I:H with minor A:L and no read, so C:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/electerm/electerm).

CVSS VectorVendor: https://github.com/electerm/electerm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 19:50 vuln.today

DescriptionCVE.org

Impact

A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization.

A malicious SSH server or remote shell process can send a specially crafted filename such as ../escaped.txt to escape the user-selected download directory and write files to arbitrary locations on the user's filesystem, subject to process permissions.

Attack scenario:

User connects to a malicious SSH server
Attacker initiates a Zmodem or Trzsz file transfer
Attacker supplies a traversal filename (e.g., ../../.bashrc, ../escaped.txt)
User accepts the transfer and selects a download directory
File is written outside the selected directory, potentially overwriting sensitive files

Affected components:

src/app/server/zmodem.js - prepareReceiveFile() at line 736
src/app/server/trzsz.js - getUniqueFilePath() at line 559, openSaveFile() callback, and savedFilePaths mapping

Patches

https://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284

Workarounds

If upgrading is not immediately possible, users can mitigate this vulnerability by:

Only connecting to trusted SSH servers
Rejecting or canceling any incoming Zmodem or Trzsz file transfers from untrusted sources
Avoiding the use of Zmodem (sz/rz) and Trzsz (trz/tsz) commands on untrusted servers

AnalysisAI

Arbitrary file write in electerm via path traversal in its Zmodem and Trzsz file-download handlers lets a malicious SSH server or remote shell overwrite files anywhere the client process can write. When a user accepts an incoming Zmodem (sz/rz) or Trzsz (trz/tsz) transfer, the attacker-supplied filename is passed unsanitized into path.join() with the chosen download directory, so a name like ../../.bashrc escapes that directory. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires the victim to initiate a connection to a hostile server and accept the transfer.

Technical ContextAI

electerm is a cross-platform Electron/Node.js terminal and SSH/SFTP client distributed as the npm package electerm. Zmodem and Trzsz are terminal file-transfer protocols that let a remote shell push files to the local client; electerm implements the receive side in src/app/server/zmodem.js (prepareReceiveFile() at line 736) and src/app/server/trzsz.js (getUniqueFilePath() at line 559, the openSaveFile() callback, and the savedFilePaths mapping). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the remote-controlled filename is concatenated to the destination directory with path.join() without validating, normalizing, or stripping traversal sequences (../), so the resolved path can point outside the intended download folder. Because the filename originates entirely from the remote peer, the trust boundary between the untrusted server and the local filesystem is crossed at the point of the join.

RemediationAI

Upgrade to the electerm release that includes fix commit fde153d677a170c5816368f6586647f3af4ef284 (Upstream fix available as a commit; a specific tagged patched version is not independently confirmed from the provided data - consult the advisory at https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc for the exact release). Until you can upgrade, apply the vendor workarounds: connect only to trusted SSH servers, and reject or cancel any incoming Zmodem or Trzsz transfer originating from an untrusted source. As a stronger compensating control, avoid using the sz/rz and trz/tsz commands entirely on servers you do not fully control, which eliminates the receive path at the cost of losing in-terminal file download on those sessions. Where feasible, run electerm under a least-privileged OS account so any successful traversal is confined to files that account can write, limiting the blast radius of an overwrite.