Electerm Command Injection Flaw Fixed in FTP/SFTP Folder Handling
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 11, 2026
Electerm fixed a high-severity command injection vulnerability tracked as CVE-2026-73224 that could let a malicious FTP or SFTP server execute arbitrary commands on a user's system. The flaw affected versions prior to 3.15.120 and was triggered when a user downloaded a crafted folder and then opened Properties and used Calculate Size. According to the advisory, the application passed a server-controlled folder name into a shell command used to run du -sh without properly escaping single quotes, creating a CWE-78 command injection condition.
The issue was addressed in Electerm v3.15.120, whose release notes describe multiple security fixes for unsafe file-name parsing across custom editor actions, FTP/SFTP transfers, folder size checks, and RDP file transfer workflows. The vulnerability carries a CVSS 3.1 rating of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high impact to confidentiality, integrity, and availability, and users are advised to upgrade to the patched release.
