EUVD-2026-56920Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Malicious RDP server is network-reachable (AV:N, AC:L), needs no victim-side privileges (PR:N), but requires active user connection (UI:R); writes files (I:H, A:H) without reading any (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.
AnalysisAI
Path traversal in electerm's RDP clipboard file transfer (prior to v3.15.120) lets a malicious RDP server write attacker-controlled files to arbitrary locations on the victim's filesystem. The fileInfo.name field from the RDP CLIPRDR protocol - fully controlled by the server - is passed unsanitized to osResolve, enabling ../ sequences to escape the user-selected save directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running electerm prior to version 3.15.120 and must establish an RDP session to an attacker-controlled or compromised RDP server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 8.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H reflects a high-severity but user-interaction-dependent vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker operates a malicious RDP server and social-engineers an electerm user into connecting (e.g., via a phishing link to a fake corporate remote-desktop endpoint). Once the session is established, the server triggers a CLIPRDR clipboard file transfer with a crafted filename such as `../../AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/malware.exe`. … |
| Remediation | Upgrade electerm to version 3.15.120 or later, available at https://github.com/electerm/electerm/releases/tag/v3.15.120. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all electerm installations across your organization and immediately notify users to avoid clipboard file transfers from untrusted RDP sources; assess your organization's RDP server trust boundaries and implement network policies restricting RDP connections to known, controlled servers only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary local code execution in electerm (versions 3.0.6-3.8.14) allows remote attackers to execute malicious code on
Arbitrary code execution in Electerm terminal client (≤3.8.15) allows attackers who control terminal output to execute c
Command injection in electerm prior to version 3.15.120 enables a malicious FTP or SFTP server operator to execute arbit
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke a
Path traversal in electerm's IPC widget loader allows local code execution with full process privileges when an attacker
Path traversal in electerm's SFTP client allows a malicious or man-in-the-middle SFTP server to write attacker-controlle
Path traversal in electerm's recursive file transfer component allows a malicious FTP or SFTP server to write attacker-c
Command injection in electerm's SFTP file editor feature allows arbitrary code execution when users edit files with mali
electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today