CVE-2026-73223

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73223
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73223.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73223
Aliases
  • GHSA-4cgc-4vgf-q55c
Published
2026-08-11T18:37:41.026Z
Modified
2026-08-14T03:51:49.452151702Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
electerm: Path traversal in editWithSystemEditor temp file path via unsanitized SFTP filename
Details

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in src/client/components/sftp/file-item.jsx is interpolated into path.resolve without sanitization. This issue is fixed in version 3.15.120.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73223.json"
}
References

Affected packages

Git / github.com/electerm/electerm

Affected ranges

Type
GIT
Repo
https://github.com/electerm/electerm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
32ea29365762b3451b1f2fcc0ef78104384db282
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.15.120"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.10.0
1.13.4
2.*
2.4.35
v0.*
v0.0.1
v0.1.0
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.13.1
v0.13.2
v0.13.3
v0.14.1
v0.14.2
v0.14.3
v0.14.4
v0.14.8
v0.15.0
v0.15.10
v0.15.3
v0.15.6
v0.16.0
v0.16.1
v0.16.22
v0.16.24
v0.16.25
v0.16.26
v0.16.27
v0.16.28
v0.16.29
v0.16.30
v0.17.0
v0.17.3
v0.18.0
v0.18.4
v0.18.5
v0.18.6
v0.18.7
v0.19.0
v0.19.1
v0.19.12
v0.19.6
v0.19.8
v0.2.0
v0.2.1
v0.2.3
v0.20.0
v0.20.1
v0.20.6
v0.20.9
v0.21.10
v0.21.13
v0.21.14
v0.21.4
v0.21.7
v0.22.0
v0.22.1
v0.22.11
v0.22.14
v0.22.17
v0.22.18
v0.22.2
v0.22.21
v0.22.23
v0.22.24
v0.22.3
v0.22.4
v0.22.6
v0.22.9
v0.23.10
v0.23.11
v0.23.12
v0.23.16
v0.23.18
v0.23.20
v0.23.21
v0.23.24
v0.23.29
v0.23.32
v0.23.41
v0.23.5
v0.23.8
v0.23.9
v0.24.1
v0.24.11
v0.24.16
v0.24.20
v0.24.23
v0.24.25
v0.24.26
v0.24.28
v0.24.3
v0.24.32
v0.24.33
v0.24.35
v0.24.36
v0.24.39
v0.24.4
v0.24.45
v0.24.5
v0.24.9
v0.25.0
v0.25.1
v0.25.18
v0.25.21
v0.25.39
v0.25.41
v0.25.48
v0.25.56
v0.25.60
v0.25.61
v0.25.65
v0.25.66
v0.25.9
v0.26.10
v0.26.12
v0.26.14
v0.26.18
v0.26.2
v0.26.20
v0.26.21
v0.26.22
v0.26.23
v0.26.24
v0.26.27
v0.26.31
v0.26.38
v0.26.40
v0.26.43
v0.26.44
v0.26.46
v0.26.47
v0.26.51
v0.26.54
v0.26.55
v0.26.57
v0.26.59
v0.26.62
v0.26.63
v0.26.67
v0.26.71
v0.26.73
v0.26.75
v0.26.76
v0.26.9
v0.27.0
v0.27.100
v0.27.105
v0.27.11
v0.27.12
v0.27.20
v0.27.22
v0.27.25
v0.27.27
v0.27.34
v0.27.37
v0.27.44
v0.27.48
v0.27.5
v0.27.50
v0.27.52
v0.27.53
v0.27.57
v0.27.60
v0.27.63
v0.27.65
v0.27.67
v0.27.68
v0.27.72
v0.27.74
v0.27.78
v0.27.79
v0.27.80
v0.27.82
v0.27.83
v0.27.84
v0.27.89
v0.27.97
v0.3.0
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.8.5
v0.9.0
v0.9.5
v1.*
v1.0.0
v1.0.13
v1.0.18
v1.0.19
v1.0.21
v1.0.23
v1.0.24
v1.0.27
v1.0.28
v1.0.31
v1.0.33
v1.0.7
v1.10.13
v1.10.14
v1.10.31
v1.10.35
v1.10.39
v1.100.18
v1.100.20
v1.100.30
v1.100.46
v1.100.50
v1.100.56
v1.100.60
v1.100.8
v1.101.10
v1.101.16
v1.101.20
v1.11.0
v1.11.1
v1.11.11
v1.11.12
v1.11.13
v1.11.16
v1.11.5
v1.11.6
v1.11.8
v1.12.0
v1.12.1
v1.12.15
v1.12.19
v1.12.2
v1.12.21
v1.12.24
v1.12.6
v1.12.7
v1.12.9
v1.13.1
v1.13.3
v1.14.0
v1.15.3
v1.16.1
v1.16.11
v1.16.21
v1.16.3
v1.16.5
v1.17.15
v1.17.16
v1.17.19
v1.17.21
v1.17.26
v1.17.3
v1.18.0
v1.18.1
v1.18.5
v1.19.0
v1.19.5
v1.2.2
v1.20.10
v1.20.4
v1.20.6
v1.21.14
v1.21.18
v1.21.20
v1.21.34
v1.21.40
v1.21.48
v1.21.57
v1.21.73
v1.21.74
v1.21.88
v1.21.9
v1.21.91
v1.21.93
v1.22.1
v1.22.20
v1.22.24
v1.22.27
v1.22.30
v1.22.33
v1.22.8
v1.23.15
v1.23.2
v1.23.20
v1.23.22
v1.23.28
v1.23.3
v1.23.32
v1.23.4
v1.23.6
v1.23.8
v1.24.13
v1.25.10
v1.25.12
v1.25.14
v1.25.16
v1.25.20
v1.25.22
v1.25.30
v1.25.40
v1.25.41
v1.25.50
v1.25.6
v1.26.0
v1.26.1
v1.26.2
v1.27.19
v1.27.20
v1.27.30
v1.27.5
v1.28.0
v1.28.1
v1.28.3
v1.28.4
v1.29.2
v1.29.4
v1.29.5
v1.3.0
v1.3.1
v1.3.10
v1.3.12
v1.3.18
v1.3.2
v1.3.21
v1.3.25
v1.3.28
v1.3.31
v1.3.34
v1.3.36
v1.3.38
v1.3.4
v1.3.42
v1.3.45
v1.3.46
v1.3.49
v1.3.5
v1.3.55
v1.3.7
v1.3.8
v1.30.9
v1.31.1
v1.32.28
v1.32.38
v1.32.46
v1.32.6
v1.33.0
v1.33.26
v1.33.36
v1.33.6
v1.34.0
v1.34.10
v1.34.20
v1.34.26
v1.34.30
v1.34.38
v1.34.39
v1.34.46
v1.34.48
v1.34.58
v1.34.6
v1.34.68
v1.35.0
v1.35.6
v1.36.1
v1.37.1
v1.37.106
v1.37.110
v1.37.121
v1.37.126
v1.37.16
v1.37.20
v1.37.36
v1.37.38
v1.37.46
v1.37.58
v1.37.6
v1.37.60
v1.37.66
v1.37.68
v1.37.80
v1.37.88
v1.37.92
v1.37.93
v1.37.96
v1.38.11
v1.38.19
v1.38.30
v1.38.41
v1.38.42
v1.38.43
v1.38.50
v1.38.60
v1.38.65
v1.38.70
v1.38.8
v1.38.80
v1.38.81
v1.38.86
v1.39.103
v1.39.109
v1.39.119
v1.39.18
v1.39.2
v1.39.31
v1.39.35
v1.39.46
v1.39.47
v1.39.5
v1.39.56
v1.39.68
v1.39.76
v1.39.88
v1.39.99
v1.40.16
v1.40.18
v1.40.20
v1.40.6
v1.5.0
v1.5.13
v1.5.15
v1.5.18
v1.5.19
v1.5.4
v1.50.21
v1.50.40
v1.50.46
v1.50.59
v1.50.65
v1.50.66
v1.51.0
v1.51.18
v1.51.3
v1.51.8
v1.60.16
v1.60.29
v1.60.32
v1.60.36
v1.60.48
v1.60.50
v1.60.56
v1.60.6
v1.7.10
v1.7.17
v1.7.18
v1.70.0
v1.70.6
v1.72.18
v1.72.26
v1.72.36
v1.72.48
v1.72.6
v1.80.18
v1.80.2
v1.80.3
v1.80.5
v1.80.6
v1.9.12
v1.9.14
v1.9.19
v1.9.24
v1.9.27
v1.9.31
v1.9.7
v1.90.6
v1.90.8
v1.91.1
v1.91.16
v1.91.8
v2.*
v2.1.16
v2.1.26
v2.1.8
v2.10.26
v2.10.6
v2.11.16
v2.11.6
v2.12.0
v2.13.0
v2.13.6
v2.15.8
v2.16.9
v2.17.16
v2.17.8
v2.2.0
v2.3.100
v2.3.103
v2.3.113
v2.3.118
v2.3.126
v2.3.136
v2.3.151
v2.3.166
v2.3.176
v2.3.18
v2.3.181
v2.3.190
v2.3.191
v2.3.198
v2.3.30
v2.3.36
v2.3.48
v2.3.58
v2.3.6
v2.3.65
v2.3.75
v2.3.85
v2.4.28
v2.4.38
v2.5.16
v2.5.6
v2.5.9
v2.6.0
v2.7.8
v2.8.16
v2.8.6
v3.*
v3.0.18
v3.0.6
v3.1.16
v3.1.26
v3.1.6
v3.10.0
v3.11.0
v3.11.11
v3.11.12
v3.12.0
v3.15.0
v3.15.100
v3.15.110
v3.15.28
v3.15.32
v3.15.50
v3.15.58
v3.15.66
v3.15.69
v3.15.76
v3.15.86
v3.15.90
v3.2.0
v3.3.8
v3.5.6
v3.6.16
v3.6.6
v3.7.16
v3.7.18
v3.7.9
v3.8.15
v3.8.6
v3.8.8
v3.9.15
v3.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73223.json"