CyberRota Analysis
AI-GeneratedElecterm versions prior to 3.15.120 are vulnerable to a directory traversal attack, allowing malicious FTP or SFTP servers to write arbitrary content outside the designated download directory due to unsanitized input handling in file transfer operations. This vulnerability poses a high risk as it could lead to unauthorized file access or system compromise. Organizations using Electerm should prioritize upgrading to the patched version to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.