CVE-2026-73223 electerm CVE debrief

Who should care

Defenders responsible for electerm deployments, particularly those using SFTP, should assess exposure and prioritize verification and remediation. This includes reviewing current electerm versions, SFTP server configurations, and monitoring for suspicious activity. Additionally, security teams and operators managing electerm installations should be aware of the potential impacts on data integrity and confidentiality.

Why it matters

CVE-2026-73223 is a high-severity vulnerability in electerm that allows a malicious SFTP server to write attacker-controlled content outside the temporary directory. Defenders should prioritize verifying and upgrading to electerm version 3.15.120 or later to prevent potential attacks. The scope of affected versions and potential impact require further verification.

• Potential unauthorized data writes outside the temporary directory
• Possible elevation of privileges through malicious SFTP server
• Required verification of electerm version and SFTP server configurations
• Potential impact on data integrity and confidentiality

Technical summary

The electerm client is vulnerable to writing attacker-controlled content outside the temporary directory due to improper sanitization of server-controlled filenames. This issue is fixed in version 3.15.120. The vulnerability arises from how electerm handles filenames provided by the SFTP server, allowing an attacker to manipulate paths and potentially write outside the intended temporary directory. This could lead to unauthorized data writes and possible elevation of privileges. The fix in version 3.15.120 addresses this issue by properly sanitizing filenames.

Defensive priority

Defenders should prioritize verifying and upgrading to electerm version 3.15.120 or later to prevent potential attacks.

Recommended defensive actions

• Verify electerm version and upgrade to 3.15.120 or later
• Review SFTP server configurations and access controls
• Monitor for suspicious activity and potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification. The electerm client is vulnerable to writing attacker-controlled content outside the temporary directory due to improper sanitization of server-controlled filenames. The fix in version 3.15.120 suggests that the issue is related to how filenames are handled during SFTP interactions. However, specific details about the vulnerability, such as the exact nature of the sanitization failure

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.