electerm CVE-2026-73223

Three explicit conditions must all be met for exploitation to succeed: first, the victim must actively connect to an attacker-controlled SFTP server or have their legitimate SFTP session intercepted via man-in-the-middle; second, the victim must specifically invoke the 'Edit with System Editor' function on a file served by the malicious server - mere directory browsing, file downloading, or other SFTP operations do not trigger the vulnerable code path in editWithSystemEditor; third, the victim must be running electerm below version 3.15.120. The CVSS UI:R metric formally confirms that user interaction is non-negotiable for exploitation. The CVSS C:N metric indicates that file content on the victim system is not exfiltrated - the attack is write-only, limiting it to integrity and availability impacts. Exploitation is entirely ruled out for users who do not use the system editor integration feature, regardless of which servers they connect to.

CVSS 8.1 High is broadly justified by the arbitrary write primitive, but real-world risk is meaningfully lower than the raw score implies. AV:N reflects that the attacker operates a network-accessible SFTP server, but this is not a spray-and-pray internet-facing service - the victim must deliberately connect to the attacker's server. UI:R is the key limiting factor: passive browsing is not enough; the user must explicitly trigger 'Edit with System Editor' on a malicious file. PR:N is correct from the attacker's perspective (they control their own server) but implies no victim-side authentication weakness. No KEV listing means active exploitation at scale is unconfirmed. EPSS data was not provided in the input; exploitation probability cannot be numerically assessed. No public POC has been identified, though the patch diff is publicly visible on GitHub and the fix is simple enough to reverse-engineer. The combination of deliberate user action against a server they connected to, plus the need for that server to be malicious or intercepted, positions this as a realistic but targeted threat rather than a mass-exploitation scenario. Organizations whose users routinely connect to external or third-party SFTP servers face the highest realistic exposure.

An attacker stands up a malicious SFTP server (or performs an active man-in-the-middle attack on an existing SFTP session) and presents a file with a crafted traversal filename such as ../../.ssh/authorized_keys or ../../.bashrc. When the electerm user connects and selects 'Edit with System Editor' on that file, electerm resolves the crafted filename to a path outside the temp directory and writes the attacker's file content there - enabling the attacker to inject an SSH authorized key for persistent access, overwrite shell initialization scripts for command execution on next login, or corrupt application configuration files. No public POC has been identified, but the fix commit makes the vulnerable code pattern trivially visible.