CVE-2026-73224
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
electerm before version 3.15.120 allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size. This is because calcLocal inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. The issue is fixed in version 3.15.120.
Risk Assessment
An attacker can take over the user's machine by executing arbitrary commands with their privileges, potentially leading to data theft or full system compromise.
Recommendation
Update electerm to version 3.15.120 or later to eliminate the vulnerability.
Original NVD description (English source)
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.