Electerm, an open‑source terminal client, uses an SFTP filename to create a temporary file for the editWithSystemEditor function. The filename is interpolated into a path.resolve call without any sanitization, enabling a malicious SFTP server to cause the client to write files outside the intended temporary directory. This path traversal flaw falls under CWE‑22 and can lead to arbitrary file creation or overwrite on the victim’s local machine, potentially enabling further compromise or privilege escalation if the written files are executable or placed in sensitive locations.

All electerm releases prior to version 3.15.120 are affected. Versions 3.15.120 and later contain the fix; users of older releases should upgrade or otherwise restrict their usage of SFTP features.

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of exploitation in the wild, and it is not listed in CISA’s KEV catalog. The most likely attack vector is a malicious SFTP server that provides a crafted filename; the attacker can target any machine running a vulnerable electerm instance that connects to such a server.