The vulnerability is a path traversal flaw in the Electerm terminal client that lets a malicious SSH server or remote shell supply a filename containing traversal components such as ../ or ../../ during Zmodem or Trzsz file transfers. Electerm concatenates the remote‑supplied filename with the user‑selected download directory using path.join() without sanitization, enabling creation of files outside the intended destination. An attacker can use this flaw to overwrite sensitive configuration files or other system files accessible to the desktop user, thereby compromising confidentiality, integrity, and availability of the affected system.

Affected products are the Electerm terminal client. Versions prior to 3.11.11 are vulnerable because the code concatenates remote‑supplied filenames with the local save path without sanitization. Version 3.11.11 and later contain the fix that sanitizes or normalizes the path. All platforms supported by Electerm that use Zmodem or Trzsz file transfers are potentially impacted.

The CVSS score of 7.1 indicates a high severity vulnerability, and its EPSS score of < 1% shows a low yet non‑zero likelihood of exploitation observed in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who controls a remote SSH server or remote shell that initiates a Zmodem or Trzsz transfer and a user who accepts the file. By providing a crafted filename, the attacker can cause Electerm to write arbitrary files outside the chosen directory, potentially overwriting critical configuration files or other user data and disrupting system availability.