endpoint-software-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Electerm fixes SFTP path traversal allowing arbitrary file writes via malicious filenames

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 11, 2026

Electerm patched a high-severity path traversal flaw, tracked as CVE-2026-73223, that could let a malicious SFTP server write attacker-controlled content outside the application's temporary directory. The bug affected versions prior to 3.15.120 and was caused by unsanitized server-controlled filenames being passed into path.resolve inside the editWithSystemEditor workflow in src/client/components/sftp/file-item.jsx. The issue is classified as CWE-22 and carries a CVSS 3.1 score vector of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, indicating high impact to integrity and availability with user interaction required.

A related GitHub commit shows Electerm added filename sanitization in its FTP/SFTP transfer logic, importing a sanitizeFilename helper and applying it to file and folder names before resolving destination paths. That remediation hardens transfer and folder-creation operations against unsafe path handling and aligns with the vendor's fix in version 3.15.120. Organizations using Electerm for remote access or file transfer should upgrade to the patched release and treat untrusted SFTP servers as a potential delivery vector for arbitrary file writes.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 11, 2026 – Aug 11, 2026

Aug 11, 20263mo ago
GitHub receives CVE-2026-73223 advisory record
The CVE entry states that security-advisories@github.com newly received the record for CVE-2026-73223, a path traversal issue in electerm affecting versions before 3.15.120. The vulnerability allows a malicious SFTP server to write attacker-controlled content outside the temporary directory via an unsanitized filename in editWithSystemEditor.
CVE-2026-73223 - electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename
Jul 11, 20264mo ago
Electerm commits filename sanitization in file-transfer component
A GitHub commit modified electerm's file-transfer code to sanitize file and folder names before resolving destination paths, adding use of a sanitizeFilename helper in src/client/components/file-transfer/transfer.jsx. The change indicates a security hardening fix for unsafe path handling during FTP/SFTP transfer and folder creation workflows.
security: Parse unsafe file name when ftp/sftp transfer · electerm/electerm@deee11f · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

CVE-2026-73223

Affected products

1 linked

Electerm

Organizations

1 linked

electerm

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cvefeed High SeverityAdvisories · Aug 11, 2026

CVE-2026-73223 - electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filenameOpen source ↗

Github WebNews · Jul 11, 2026

security: Parse unsafe file name when ftp/sftp transfer · electerm/electerm@deee11f · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

endpoint-software-vulnerabilitywidely-deployed-product-advisoryinitial-access-method

Electerm fixes SFTP path traversal allowing arbitrary file writes via malicious filenames

Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 11, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 11, 2026 – Aug 11, 2026

Aug 11, 20263mo ago
GitHub receives CVE-2026-73223 advisory record
The CVE entry states that security-advisories@github.com newly received the record for CVE-2026-73223, a path traversal issue in electerm affecting versions before 3.15.120. The vulnerability allows a malicious SFTP server to write attacker-controlled content outside the temporary directory via an unsanitized filename in editWithSystemEditor.
CVE-2026-73223 - electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename
Jul 11, 20264mo ago
Electerm commits filename sanitization in file-transfer component
A GitHub commit modified electerm's file-transfer code to sanitize file and folder names before resolving destination paths, adding use of a sanitizeFilename helper in src/client/components/file-transfer/transfer.jsx. The change indicates a security hardening fix for unsafe path handling during FTP/SFTP transfer and folder creation workflows.
security: Parse unsafe file name when ftp/sftp transfer · electerm/electerm@deee11f · GitHub

Linked entities