CVE-2026-73224

Name of the Vulnerable Software and Affected Versions electerm versions prior to 3.15.120

Description A flaw exists where a malicious FTP or SFTP server can execute arbitrary commands on a user's system. This occurs when a user downloads a specially crafted folder and selects the Properties and Calculate Size options. The issue stems from the calcLocal() function in src/client/components/sftp/file-info-modal.jsx, which incorporates a server-controlled folder name into a du -sh shell command without properly escaping single quotes, leading to command injection.

Recommendations Update to version 3.15.120.