CVE-2026-73225highCWE-22

CVE-2026-73225: falha de alta gravidade em electerm

electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename

Publicada em

Seguir esta CVE+ Monitorar electerm

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.5%
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Produtos afetados
electerm · electerm
CVEs relacionadas — electerm

No mesmo produto, das mais perigosas para as menos.

CVE-2026-41500CRITICALelecterm has Command Injection Vulnerability via runMac functionEPSS 1.6%CVE-2026-41501CRITICALelecterm has Command Injection Vulnerability via runLinux functionEPSS 1.3%CVE-2026-49255HIGHelecterm: Command Injection in File System Operations (rmrf, mv, cp)EPSS 0.8%CVE-2026-73226HIGHElecterm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlistEPSS 0.8%CVE-2026-73224HIGHElecterm check folder size function may get attacked by unsafe folder nameEPSS 0.7%CVE-2026-73227HIGHelecterm's RDP clipboard file download may parse unsafe file nameEPSS 0.5%