Loading story…
Electerm fixed a high-severity command injection vulnerability tracked as CVE-2026-73224 that could let a malicious FTP or SFTP server execute arbitrary commands on a user's system. The flaw affected versions prior to 3.15.120 and was triggered when a user downloaded a crafted folder and then opened Properties and used Calculate Size. According to the advisory, the application passed a server-controlled folder name into a shell command used to run du -sh without properly escaping single quotes, creating a CWE-78 command injection condition.
The issue was addressed in Electerm v3.15.120, whose release notes describe multiple security fixes for unsafe file-name parsing across custom editor actions, FTP/SFTP transfers, folder size checks, and RDP file transfer workflows. The vulnerability carries a CVSS 3.1 rating of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high impact to confidentiality, integrity, and availability, and users are advised to upgrade to the patched release.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-73224 was newly received by security-advisories@github.com. The vulnerability describes a command injection flaw in Electerm's folder size calculation that can let a malicious FTP or SFTP server execute arbitrary commands after user interaction.
Electerm released version 3.15.120, which included multiple security fixes for unsafe file name parsing, including the folder size check workflow affected by CVE-2026-73224. The release notes also mention fixes for custom editor operations, FTP/SFTP transfers, and RDP file transfer.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Electerm patched a high-severity path traversal flaw, tracked as **CVE-2026-73223**, that could let a malicious SFTP server write attacker-controlled content outside the application's temporary directory. The bug affected versions prior to **3.15.120** and was caused by unsanitized server-controlled filenames being passed into `path.resolve` inside the `editWithSystemEditor` workflow in `src/client/components/sftp/file-item.jsx`. The issue is classified as **CWE-22** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`, indicating high impact to integrity and availability with user interaction required. A related GitHub commit shows Electerm added filename sanitization in its FTP/SFTP transfer logic, importing a `sanitizeFilename` helper and applying it to file and folder names before resolving destination paths. That remediation hardens transfer and folder-creation operations against unsafe path handling and aligns with the vendor's fix in version **3.15.120**. Organizations using Electerm for remote access or file transfer should upgrade to the patched release and treat untrusted SFTP servers as a potential delivery vector for arbitrary file writes.
Aug 12, 2026
A high-severity vulnerability tracked as **CVE-2026-63090** affects ProFTPD's `mod_sftp` module and can allow a low-privilege authenticated user to achieve remote code execution. Public reporting describes the bug as a heap-based buffer overflow triggered by crafted SFTP or SSH authentication traffic, with one account tying exploitation to malformed SFTP packet fragment reassembly in `fxp.c` and another linking it to improper bounds checking in `sftp_ssh2_userauth_callback`. In both cases, the flaw can corrupt heap memory and potentially give an attacker control of the ProFTPD process, creating a path to data theft, persistence, and lateral movement. Affected versions cited across disclosures include multiple ProFTPD `1.3.8` and `1.3.9` releases prior to patched builds, with fixes reported in versions such as **1.3.8c**, **1.3.9b**, **1.3.9c**, and **1.3.10rc3** depending on branch and advisory. The issue carries a **CVSS 8.8** rating, and while no active exploitation was reported at disclosure, defenders were urged to patch immediately, disable `mod_sftp` where it is not required, and restrict SSH/SFTP access to trusted users and networks to reduce exposure.
Jul 22, 2026
Two vulnerabilities in **sshfs** were disclosed and fixed in version **3.7.6**, affecting versions up to **3.7.5**. The more severe issue, **CVE-2026-47187**, is a symlink escape flaw that lets a rogue SFTP server trick the client into reading from or writing to unintended paths on the local filesystem by returning unsafe symlink targets. The second bug, **CVE-2026-48711**, is an argument injection weakness in hostname parsing that can turn a crafted mount source into an SSH option, enabling arbitrary local command execution under specific conditions and, in some cases, without requiring SSH authentication. Public technical details and exploit code have now been released, raising the risk of active abuse against systems that use sshfs to mount remote directories over SFTP. The flaws were privately reported by Abhinav Agarwal and addressed through a coordinated release, but defenders are being urged to upgrade immediately to **sshfs 3.7.6 or later** and verify trusted remote server keys, as a malicious or spoofed server could otherwise trigger client-side compromise.
Aug 19, 2026