EUVD-2026-56907Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
AV:N because attack originates from a network SFTP server; PR:N as attacker controls their own server; UI:R requires explicit system-editor action; C:N since no data is read or exfiltrated.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.
AnalysisAI
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlled file content to arbitrary locations on the connecting user's filesystem, bypassing the intended temporary directory confinement. All electerm releases prior to 3.15.120 are affected across all supported platforms (Linux, macOS, Windows). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three explicit conditions must all be met for exploitation to succeed: first, the victim must actively connect to an attacker-controlled SFTP server or have their legitimate SFTP session intercepted via man-in-the-middle; second, the victim must specifically invoke the 'Edit with System Editor' function on a file served by the malicious server - mere directory browsing, file downloading, or other SFTP operations do not trigger the vulnerable code path in editWithSystemEditor; third, the victim must be running electerm below version 3.15.120. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.1 High is broadly justified by the arbitrary write primitive, but real-world risk is meaningfully lower than the raw score implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker stands up a malicious SFTP server (or performs an active man-in-the-middle attack on an existing SFTP session) and presents a file with a crafted traversal filename such as ../../.ssh/authorized_keys or ../../.bashrc. When the electerm user connects and selects 'Edit with System Editor' on that file, electerm resolves the crafted filename to a path outside the temp directory and writes the attacker's file content there - enabling the attacker to inject an SSH authorized key for persistent access, overwrite shell initialization scripts for command execution on next login, or corrupt application configuration files. … |
| Remediation | Upgrade electerm to version 3.15.120 or later immediately; this is the vendor-released patch confirmed by tagged GitHub release at https://github.com/electerm/electerm/releases/tag/v3.15.120 and fix commit 32ea29365762b3451b1f2fcc0ef78104384db282. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all electerm installations and identify affected versions across Linux, macOS, and Windows systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbit
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke a
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-c
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today