EUVD-2026-56916Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Network vector because attacker controls the server; PR:N as no victim-system credentials required; UI:R because victim must actively initiate the download; C:N as the attack is write-only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.
AnalysisAI
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-controlled content to arbitrary locations on the victim's filesystem, bypassing the user-selected download directory. The root cause is in src/client/components/file-transfer/transfer.jsx where server-supplied file.name and folder.name values are passed unsanitized to Node.js resolve(), permitting traversal sequences such as ../../ to escape the intended directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running electerm prior to version 3.15.120 and must initiate a recursive file download from an attacker-controlled FTP or SFTP server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) reflects high integrity and availability impact with no special attack complexity beyond convincing the victim to download from a malicious server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operates a malicious FTP or SFTP server and socially engineers an electerm user into connecting and downloading a file tree - for example, by sharing a server address for a software package or dataset. The server returns file or directory entries with names containing `../../` traversal sequences, causing electerm to write attacker-supplied content to locations such as `~/.ssh/authorized_keys` or `~/.bashrc`, enabling persistent access or immediate code execution at next shell login. … |
| Remediation | Upgrade electerm to version 3.15.120 or later; this is the vendor-released patch confirmed at https://github.com/electerm/electerm/releases/tag/v3.15.120. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running electerm and determine exposure level by reviewing which instances receive files from external or partially-trusted SFTP/FTP servers; escalate any internet-facing file transfer endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbit
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke a
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlle
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today