These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-49253 vulnerability affects electerm, an open-sourced terminal/SSH/SFTP client. This path traversal issue allows a malicious SSH server or remote shell to write outside the intended download directory, potentially overwriting sensitive files. Users should review their deployment and update to version 3.11.11 or later. The issue arises from electerm's use of remote-supplied filenames directly [truncated]
CVE-2026-73227 is a high-severity vulnerability in electerm, an open-source terminal/SSH/SFTP client. Prior to version 3.15.120, a malicious RDP server can write attacker-controlled content outside the selected save directory due to improper sanitization of the RDP clipboard download path. This issue is fixed in version 3.15.120. Defenders responsible for electerm installations, particularly those using R [truncated]
CVE-2026-73226 is a high-severity vulnerability in electerm, an open-source terminal/SSH/SFTP client. An authenticated WebSocket client can invoke internal functions, allowing command execution, file access, and process termination. The issue is fixed in version 3.15.186. This vulnerability allows an attacker to execute commands, access files, and terminate processes, potentially leading to a compromise o [truncated]
This PatchSiren debrief provides defensive context on CVE-2026-73225, a vulnerability in electerm, an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. The issue allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory due to unsanitized server-supplied file and folder names during recursive transfers.
A vulnerability in electerm, a terminal/SSH/SFTP client, allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size. This issue arises from the calcLocal function in src/client/components/sftp/file-info-modal.jsx, which inserts the server-controlled folder name into a du -sh shell command without safely escaping sing [truncated]
CVE-2026-73223 is a high-severity vulnerability in electerm, an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. A malicious SFTP server can write attacker-controlled content outside the temporary directory due to improper sanitization of server-controlled filenames. This issue is fixed in version 3.15.120. The vulnerability allows an attacker to potentially write outside the tem [truncated]
CVE-2026-45787 documents cryptographic weaknesses in electerm, an open-source terminal/SSH/SFTP client, affecting versions prior to 3.9.5. The vulnerability stems from deterministic AES-192-CBC encryption using a fixed zero initialization vector (IV), constant key derivation function (KDF) salt, and absence of message authentication code (MAC) protection for synchronized bookmark and profile data. These i [truncated]
A critical vulnerability in electerm, an open-source terminal/SSH/SFTP client, affects versions 3.0.6 through 3.8.8. The vulnerability involves code injection weaknesses (CWE-94, CWE-732, CWE-940) that could allow an attacker with local access and low privileges to achieve complete compromise of confidentiality, integrity, and availability on the affected system. The CVSS 4.0 vector indicates local attack [truncated]
CVE-2026-45058 documents a critical remote code execution vulnerability in electerm, an open-source terminal/SSH/SFTP client. The flaw exists in versions 3.8.8 and earlier, where maliciously crafted bookmark JSON files or compromised sync configurations (Gist/WebDAV) can inject arbitrary commands through exec* fields or global configuration parameters. When a user imports a malicious bookmark or syncs fro [truncated]