Description
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
Published: 2026-08-11
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Electerm's calculate size feature builds an unescaped shell command from the folder name, allowing a malicious FTP or SFTP host to execute arbitrary shell commands on the client when a user selects an attacker‑controlled folder. This is a classic command injection flaw (CWE‑78) that can lead to local code execution with the privileges of the user running the application.

Affected Systems

The bug exists in all Electerm releases earlier than 3.15.120. Users must verify that their installed version is at least 3.15.120.

Risk and Exploitability

The CVSS score of 8.8 classifies it as high severity. EPSS indicates a very low probability of exploitation, and the issue is not present in CISA's KEV catalog. Nevertheless, the flaw can be triggered only when a user explicitly opens properties on a folder supplied by a malicious server, so the attack vector is local via the client interface. Adequate patching or avoidance of the vulnerable operation mitigates the risk.

Generated by OpenCVE AI on August 12, 2026 at 20:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Electerm to version 3.15.120 or later, which sanitizes the folder name before executing the du command.
  • For environments that cannot immediately upgrade, do not use the Properties → Calculate Size feature on folders retrieved from untrusted FTP or SFTP servers.
  • As a temporary workaround, disable the calculate size feature or modify the source to escape single quotes; however, the official fix is the upgrade.

Generated by OpenCVE AI on August 12, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Electerm
Electerm electerm
Vendors & Products Electerm
Electerm electerm

Tue, 11 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
Title Electerm check folder size function may get attacked by unsafe folder name
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Electerm Electerm
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T14:37:48.306Z

Reserved: 2026-08-11T14:41:20.122Z

Link: CVE-2026-73224

cve-icon Vulnrichment

Updated: 2026-08-13T14:37:44.700Z

cve-icon NVD

Status : Received

Published: 2026-08-11T19:18:52.030

Modified: 2026-08-13T15:20:09.360

Link: CVE-2026-73224

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T20:45:08Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')