Read the docs
TI-2026-36449 Aliases CVE-2026-49253GHSA-38j7-23hf-9mhc

electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling

Priority MEDIUM 64CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Fixed electerm (electerm): 3.11.11electerm (npm): 3.11.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
electermelectermbefore 3.11.113.11.11Patch availableCNA
—electerm (npm)before 3.11.113.11.11Patch availableGHSA-38j7-23hf-9mhc
  • electerm Vendorelecterm Affected before 3.11.11 Fixed in 3.11.11 Patch available CNA
  • electerm (npm) Vendor— Affected before 3.11.11 Fixed in 3.11.11 Patch available GHSA-38j7-23hf-9mhc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:*——electerm
  • cpe:2.3:a:electerm_project:electerm:*:*:*:*:*:*:*:* Versions — — ·electerm

Remediation

  • Fix · CNA electerm (electerm) Fixed in 3.11.11
  • Fix · GHSA-38j7-23hf-9mhc electerm (npm) Fixed in 3.11.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49253
  2. 2026-10-03 Alias added: GHSA-38j7-23hf-9mhc

References

Other 4

  • TI-2020-14501 An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code… CVSS 3.1CRITICAL 9.8
  • TI-2026-30086 electerm has Command Injection Vulnerability via runMac function CVSS 3.1CRITICAL 9.8
  • TI-2026-30087 electerm has Command Injection Vulnerability via runLinux function CVSS 3.1CRITICAL 9.8
  • TI-2026-31998 Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link click CVSS 3.1CRITICAL 9.6
  • TI-2026-32907 electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark CVSS 4.0CRITICAL 9.4
  • TI-2026-32001 electerm: dangerous code can be run through links or command line CVSS 4.0CRITICAL 9.4
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences