Electerm, an open‑source terminal client, contains a flaw that allows a malicious RDP server to specify a clipboard file name that the client downloads. The filename is passed directly to the operating system without sanitization, enabling the attacker to cause the client to write files outside the chosen download directory. This path‑traversal flaw (CWE‑22) lets an attacker create or overwrite arbitrary files on the local machine, potentially leading to code execution or persistence.

The vulnerability affects all electerm users running any version older than 3.15.120. The problematic code resides in src/client/components/rdp/file-transfer.js of the electerm application, which is distributed under the electerm:electerm designation.

The CVSS score of 8.1 highlights a high severity, while an EPSS score of less than 1% indicates that exploitation is currently rare but not impossible. The vulnerability is not listed in CISA KEV catalog. An attacker must establish an RDP session with a malicious or compromised server; no additional local privilege escalation is required beyond the electerm user’s permissions. Successful exploitation would allow the attacker to write arbitrary files to the victim’s file system, which could be used to install malware or modify system settings.