CVE-2026-73224highCWE-78

CVE-2026-73224: fallo de gravedad alta en electerm

Electerm check folder size function may get attacked by unsafe folder name

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear electerm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.7%
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
electerm · electerm
CVEs relacionadas — electerm

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-41500CRITICALelecterm has Command Injection Vulnerability via runMac functionEPSS 1.6%CVE-2026-41501CRITICALelecterm has Command Injection Vulnerability via runLinux functionEPSS 1.3%CVE-2026-49255HIGHelecterm: Command Injection in File System Operations (rmrf, mv, cp)EPSS 0.8%CVE-2026-73226HIGHElecterm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlistEPSS 0.8%CVE-2026-73227HIGHelecterm's RDP clipboard file download may parse unsafe file nameEPSS 0.5%CVE-2026-73225HIGHelecterm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filenameEPSS 0.5%