{"id":"EUVD-2026-62421","enisaUuid":"0092074c-8e2a-3bde-a4cb-e5d68fc65065","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.","datePublished":"Aug 19, 2026, 2:31:55 PM","dateUpdated":"Aug 21, 2026, 7:31:45 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc\nhttps://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284\nhttps://github.com/electerm/electerm/releases/tag/v3.11.11\n","aliases":"CVE-2026-49253\nGHSA-38j7-23hf-9mhc\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"eeac1bda-5c23-3041-8f34-cae6c33dae78","product":{"name":"electerm","vendor":{"name":"electerm"}},"product_version":"\u003c 3.11.11"}],"enisaIdVendor":[{"id":"c7a27a48-4cb6-3577-8077-7bae24434a34","vendor":{"name":"electerm"}}],"enisaIdVulnerability":[{"id":"1c32fd09-671e-3143-836c-bf859ace80a8","vulnerability":{"id":"CVE-2026-49253","description":"electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.","datePublished":"Aug 19, 2026, 2:31:55 PM","dateUpdated":"Aug 21, 2026, 7:31:45 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc\nhttps://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284\nhttps://github.com/electerm/electerm/releases/tag/v3.11.11\n","enisa_id":"EUVD-2026-62421\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"063c7f74-bcbd-3edf-8eb3-f2b70059b739","product":{"name":"electerm","vendor":{"name":"electerm"}},"product_version":"\u003c 3.11.11"}],"vulnerabilityVendor":[{"id":"b7e44a55-8cdc-3c0c-8c02-36b08664b185","vendor":{"name":"electerm"}}]}},{"id":"9650fed9-fb9b-3deb-aa50-6cec8b52f70d","vulnerability":{"id":"GHSA-38j7-23hf-9mhc","description":"electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling","datePublished":"Jul 2, 2026, 7:20:20 PM","dateUpdated":"Jul 2, 2026, 7:20:20 PM","baseScore":0.0,"references":"https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc\nhttps://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284\nhttps://github.com/electerm/electerm\n","enisa_id":"EUVD-2026-62421\n","aliases":"CVE-2026-49253\nGHSA-38j7-23hf-9mhc\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}