Loading story…
Electerm patched a high-severity path traversal flaw, tracked as CVE-2026-73223, that could let a malicious SFTP server write attacker-controlled content outside the application's temporary directory. The bug affected versions prior to 3.15.120 and was caused by unsanitized server-controlled filenames being passed into path.resolve inside the editWithSystemEditor workflow in src/client/components/sftp/file-item.jsx. The issue is classified as CWE-22 and carries a CVSS 3.1 score vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, indicating high impact to integrity and availability with user interaction required.
A related GitHub commit shows Electerm added filename sanitization in its FTP/SFTP transfer logic, importing a sanitizeFilename helper and applying it to file and folder names before resolving destination paths. That remediation hardens transfer and folder-creation operations against unsafe path handling and aligns with the vendor's fix in version 3.15.120. Organizations using Electerm for remote access or file transfer should upgrade to the patched release and treat untrusted SFTP servers as a potential delivery vector for arbitrary file writes.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry states that security-advisories@github.com newly received the record for CVE-2026-73223, a path traversal issue in electerm affecting versions before 3.15.120. The vulnerability allows a malicious SFTP server to write attacker-controlled content outside the temporary directory via an unsanitized filename in editWithSystemEditor.
A GitHub commit modified electerm's file-transfer code to sanitize file and folder names before resolving destination paths, adding use of a sanitizeFilename helper in src/client/components/file-transfer/transfer.jsx. The change indicates a security hardening fix for unsafe path handling during FTP/SFTP transfer and folder creation workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Electerm fixed a high-severity command injection vulnerability tracked as **`CVE-2026-73224`** that could let a malicious FTP or SFTP server execute arbitrary commands on a user's system. The flaw affected versions prior to **`3.15.120`** and was triggered when a user downloaded a crafted folder and then opened **Properties** and used **Calculate Size**. According to the advisory, the application passed a server-controlled folder name into a shell command used to run `du -sh` without properly escaping single quotes, creating a **CWE-78** command injection condition. The issue was addressed in Electerm **`v3.15.120`**, whose release notes describe multiple security fixes for unsafe file-name parsing across custom editor actions, FTP/SFTP transfers, folder size checks, and RDP file transfer workflows. The vulnerability carries a **CVSS 3.1** rating of **`AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`**, indicating high impact to confidentiality, integrity, and availability, and users are advised to upgrade to the patched release.
Aug 12, 2026
Tabby released version **1.0.235** to fix **`CVE-2026-72903`** / **`GHSA-59p9-8gwf-v9v7`**, a high-severity Windows SFTP path traversal flaw affecting versions prior to the update. The vulnerability allowed a malicious SFTP server to return crafted filenames containing backslashes and `..` segments that Tabby preserved, enabling files to be created or overwritten outside the user-selected download folder or temporary edit directory. The issue is rated **CVSS 8.1** and is remotely exploitable with user interaction. The patch introduced a path validation helper, **`resolveInsideBase`**, to ensure resolved paths remain within an intended base directory, replacing earlier path handling in directory creation, file creation, and SFTP temporary file workflows in Tabby Electron components. The same release also included two shell injection mitigations by replacing `exec()` with `execFile()` in `shellIntegration.service` and `app.ts`, alongside unrelated feature updates and bug fixes.
Aug 11, 2026
A critical flaw tracked as **CVE-2026-47187** affects **SSHFS** versions earlier than **3.7.6**, allowing a malicious or rogue **SFTP** server to trigger local file read or write on a client system through crafted symlinks. The issue stems from SSHFS passing absolute symlink targets or relative targets containing `..` traversal components through FUSE, after which the local kernel VFS can resolve those paths outside the mounted filesystem. If a user or client-side tool such as `cp`, `rsync`, backup software, or an editor follows the link, local readable files can be exposed or attacker-controlled data can be written into writable local files, including startup or scheduled-task locations. The fix was merged into **libfuse/sshfs** as a new **`contain_symlinks`** protection that is enabled by default and rejects absolute symlink targets and any target containing `..`, returning **`EPERM`**. Maintainers described the approach as intentionally strict and lexical because an adversarial filesystem can manipulate intermediate path components, making depth-based checks unreliable. The update also adds a **`no_contain_symlinks`** opt-out for trusted legacy environments, updates documentation, and includes tests covering blocked traversal attempts, safe symlinks, option precedence, and interactions with `transform_symlinks`.
Aug 19, 2026