CVE-2026-73223

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.15.120

Description A path traversal issue exists where a malicious SFTP server can write attacker-controlled content outside the temporary directory. This occurs because the server-controlled filename used by the editWithSystemEditor() function in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without proper sanitization. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update to version 3.15.120.