CVE-2026-73224 electerm CVE debrief

Who should care

Defenders responsible for electerm clients, especially those accessing FTP or SFTP servers, should assess exposure and prioritize upgrading to version 3.15.120 or later. This includes IT administrators, security teams, and operators who interact with electerm clients in their environments. They should review electerm client configurations, user interactions with FTP and SFTP servers, and implement additional security measures to mitigate potential risks.

Why it matters

CVE-2026-73224 allows a malicious FTP or SFTP server to execute arbitrary commands on electerm clients. Defenders should prioritize verifying and upgrading to electerm version 3.15.120 or later, especially for systems and users accessing FTP or SFTP servers.

• Potential for arbitrary command execution on electerm clients
• Possible disruption of service or data integrity
• Need for verification of electerm version and exposure
• Priority for upgrading to fixed version

Technical summary

The electerm client is vulnerable to arbitrary command execution when a user downloads a crafted folder from a malicious FTP or SFTP server and invokes Properties and Calculate Size. The issue arises from the calcLocal function in src/client/components/sftp/file-info-modal.jsx, which inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This allows attackers to execute arbitrary commands on the client system. The vulnerability is fixed in electerm version 3.15.120.

Defensive priority

Defenders should prioritize verifying and upgrading to electerm version 3.15.120 or later, especially for systems and users accessing FTP or SFTP servers.

Recommended defensive actions

• Verify and upgrade to electerm version 3.15.120 or later
• Review and restrict access to untrusted FTP and SFTP servers
• Monitor for suspicious activity on electerm clients
• Conduct a thorough review of electerm client configurations and user interactions with FTP and SFTP servers
• Implement additional security measures such as network segmentation and intrusion detection
• Develop and test incident response plans for potential exploitation
• Ensure that all electerm clients are properly patched and maintained

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected systems is limited. Defenders should verify electerm version and exposure, especially for systems and users accessing FTP or SFTP servers. The vulnerability allows a malicious FTP or SFTP server to execute arbitrary commands on electerm clients. There is no evidence of public exploitation, but defenders should prioritize verification and upgrading to electerm 3.15.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.