CVE-2026-49253

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.11.11

Description A path traversal issue exists in the Zmodem and Trzsz file download handlers. The software uses remote-supplied filenames directly with the path.join() function when receiving transfers, without proper sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components, such as ../escaped.txt or ../../.bashrc, allowing the application to write files outside the user-selected download directory. This can lead to the overwriting of sensitive configuration files or impairment of system availability. The issue is present in the prepareReceiveFile() function within src/app/server/zmodem.js, as well as the getUniqueFilePath() function, the openSaveFile() callback, and the savedFilePaths mapping within src/app/server/trzsz.js.

Recommendations Update to version 3.11.11. Only connect to trusted SSH servers. Reject or cancel incoming Zmodem or Trzsz file transfers from untrusted sources. Avoid using Zmodem (sz/rz) and Trzsz (trz/tsz) commands on untrusted servers.