CVE-2026-73225

8.1 Élevée

Publiée le 11/08/2026 à 21:18 · Modifiée le 09/09/2026 à 22:55 · Analyse NVD reportée · Source : security-advisories@github.com

Description

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.

Traduire en français

Produits concernés

electerm

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-22

Références

https://github.com/electerm/electerm/commit/deee11ffe558eaee5cad5822949ba3a7f87ae56a
https://github.com/electerm/electerm/releases/tag/v3.15.120
https://github.com/electerm/electerm/security/advisories/GHSA-6wh4-q387-x93j

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories