Electerm versions prior to 3.15.120 allow a malicious FTP or SFTP server to send file or folder names that include traversal characters. During a recursive download the client passes these unsanitized names directly to the file system resolve function, enabling creation or overwriting of files outside the intended download directory. This flaw is a classic path traversal (CWE‑22) that can lead to arbitrary local file write or replacement with attacker‑controlled content, potentially enabling the execution of malicious code on the client system.

All installations of the electerm client running a version older than 3.15.120 are vulnerable. The issue is fixed in version 3.15.120 and newer, so any system still using an earlier release is affected.

With a CVSS score of 8.1 the vulnerability is judged as high severity. The EPSS score is below 1 %, indicating a very low likelihood of widespread exploitation at the time of analysis, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to control an FTP/SFTP server that the client connects to and to initiate or request a recursive folder download. An attacker can then supply filenames that traverse directories and write or overwrite files in or outside the selected download folder, potentially compromising the client’s local file system.