CVE-2026-49253

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback, and the savedFilePaths mapping construct destinations without sanitization. A malicious SSH server or remote shell can provide a filename containing traversal components such as ../escaped.txt or ../../.bashrc. When the victim accepts the transfer and selects a download directory, electerm can write outside that directory and overwrite files accessible to the desktop user, potentially changing sensitive configuration or impairing availability. This issue is fixed in version 3.11.11.

• CWE-22

• https://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284
• https://github.com/electerm/electerm/releases/tag/v3.11.11
• https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc
• https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49247Jellyfin is an open source self hosted media server. From 10…8.8
• CVE-2026-49248OneDev is a Git server with CI/CD, kanban, and packages. In …8.3
• CVE-2026-49249Boruta is a standalone authorization server that aims to imp…7.1
• CVE-2026-4925Improper access control in the users MFA feature in Devoluti…5
• CVE-2026-49250Conform, a type-safe form validation library, allows the par…8.7
• CVE-2026-49252deepstream is a server that allows clients and backend servi…9.9
• CVE-2026-49254Dragonfly is an open source P2P-based file distribution and …2.9
• CVE-2026-49255electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…8.8
• CVE-2026-49256Discourse is an open-source discussion platform. Prior to 20…7.5
• CVE-2026-49257mcp-pinot is a Python-based Model Context Protocol (MCP) ser…10
• CVE-2026-49258Nebula Mesh is a self-hosted control plane for the Slack Neb…8.8
• CVE-2026-4926Impact: A bad regular expression is generated any time you …7.5