electerm CVE-2026-73225

The victim must be running electerm prior to version 3.15.120 and must initiate a recursive file download from an attacker-controlled FTP or SFTP server. No special electerm configuration is required - the vulnerability exists in the default recursive transfer behavior. Exploitation is bounded by the need for user interaction (CVSS UI:R): the victim must actively connect to and download from the malicious server, ruling out fully automated mass exploitation (SSVC Automatable: no). The attacker requires no credentials on the victim's system (CVSS PR:N) and no prior foothold - only the ability to present a malicious server. Limiting factors include the social engineering prerequisite and the requirement that the victim uses electerm's file transfer feature rather than just the terminal; users who never download files via FTP/SFTP in electerm are not exposed.

The CVSS 8.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no special attack complexity beyond convincing the victim to download from a malicious server. SSVC corroborates this with 'Technical Impact: total' but also flags 'Automatable: no', consistent with UI:R - exploitation cannot be scripted without social engineering or a compromised legitimate server. SSVC 'Exploitation: none' aligns with the absence of a KEV listing and no publicly identified proof-of-concept. EPSS data was not supplied, so exploitation probability cannot be quantified numerically. The absence of C impact (C:N) is consistent with the write-only nature of path traversal here; confidentiality is not directly threatened. Real-world priority is moderate: users who connect only to trusted FTP/SFTP servers face negligible risk, while users who connect to third-party or community-hosted servers face meaningful risk of arbitrary file writes that could lead to code execution via overwritten shell configs or SSH authorized_keys files.

An attacker operates a malicious FTP or SFTP server and socially engineers an electerm user into connecting and downloading a file tree - for example, by sharing a server address for a software package or dataset. The server returns file or directory entries with names containing ../../ traversal sequences, causing electerm to write attacker-supplied content to locations such as ~/.ssh/authorized_keys or ~/.bashrc, enabling persistent access or immediate code execution at next shell login. No proof-of-concept exploit has been publicly identified, but the attack primitive is well-understood and straightforward to implement given the confirmed code path.