CVE-2026-73225

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73225
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73225.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73225
Aliases
  • GHSA-6wh4-q387-x93j
Published
2026-08-11T18:42:16.087Z
Modified
2026-08-13T04:02:49.570587898Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
electerm: Path traversal in FTP/SFTP recursive folder download via unsanitized server filename
Details

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73225.json"
}
References

Affected packages

Git / github.com/electerm/electerm

Affected ranges

Type
GIT
Repo
https://github.com/electerm/electerm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
deee11ffe558eaee5cad5822949ba3a7f87ae56a
Fixed
32ea29365762b3451b1f2fcc0ef78104384db282
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.15.120"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.10.0
1.13.4
2.*
2.4.35
v0.*
v0.0.1
v0.1.0
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.13.1
v0.13.2
v0.13.3
v0.14.1
v0.14.2
v0.14.3
v0.14.4
v0.14.8
v0.15.0
v0.15.10
v0.15.3
v0.15.6
v0.16.0
v0.16.1
v0.16.22
v0.16.24
v0.16.25
v0.16.26
v0.16.27
v0.16.28
v0.16.29
v0.16.30
v0.17.0
v0.17.3
v0.18.0
v0.18.4
v0.18.5
v0.18.6
v0.18.7
v0.19.0
v0.19.1
v0.19.12
v0.19.6
v0.19.8
v0.2.0
v0.2.1
v0.2.3
v0.20.0
v0.20.1
v0.20.6
v0.20.9
v0.21.10
v0.21.13
v0.21.14
v0.21.4
v0.21.7
v0.22.0
v0.22.1
v0.22.11
v0.22.14
v0.22.17
v0.22.18
v0.22.2
v0.22.21
v0.22.23
v0.22.24
v0.22.3
v0.22.4
v0.22.6
v0.22.9
v0.23.10
v0.23.11
v0.23.12
v0.23.16
v0.23.18
v0.23.20
v0.23.21
v0.23.24
v0.23.29
v0.23.32
v0.23.41
v0.23.5
v0.23.8
v0.23.9
v0.24.1
v0.24.11
v0.24.16
v0.24.20
v0.24.23
v0.24.25
v0.24.26
v0.24.28
v0.24.3
v0.24.32
v0.24.33
v0.24.35
v0.24.36
v0.24.39
v0.24.4
v0.24.45
v0.24.5
v0.24.9
v0.25.0
v0.25.1
v0.25.18
v0.25.21
v0.25.39
v0.25.41
v0.25.48
v0.25.56
v0.25.60
v0.25.61
v0.25.65
v0.25.66
v0.25.9
v0.26.10
v0.26.12
v0.26.14
v0.26.18
v0.26.2
v0.26.20
v0.26.21
v0.26.22
v0.26.23
v0.26.24
v0.26.27
v0.26.31
v0.26.38
v0.26.40
v0.26.43
v0.26.44
v0.26.46
v0.26.47
v0.26.51
v0.26.54
v0.26.55
v0.26.57
v0.26.59
v0.26.62
v0.26.63
v0.26.67
v0.26.71
v0.26.73
v0.26.75
v0.26.76
v0.26.9
v0.27.0
v0.27.100
v0.27.105
v0.27.11
v0.27.12
v0.27.20
v0.27.22
v0.27.25
v0.27.27
v0.27.34
v0.27.37
v0.27.44
v0.27.48
v0.27.5
v0.27.50
v0.27.52
v0.27.53
v0.27.57
v0.27.60
v0.27.63
v0.27.65
v0.27.67
v0.27.68
v0.27.72
v0.27.74
v0.27.78
v0.27.79
v0.27.80
v0.27.82
v0.27.83
v0.27.84
v0.27.89
v0.27.97
v0.3.0
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.8.5
v0.9.0
v0.9.5
v1.*
v1.0.0
v1.0.13
v1.0.18
v1.0.19
v1.0.21
v1.0.23
v1.0.24
v1.0.27
v1.0.28
v1.0.31
v1.0.33
v1.0.7
v1.10.13
v1.10.14
v1.10.31
v1.10.35
v1.10.39
v1.100.18
v1.100.20
v1.100.30
v1.100.46
v1.100.50
v1.100.56
v1.100.60
v1.100.8
v1.101.10
v1.101.16
v1.101.20
v1.11.0
v1.11.1
v1.11.11
v1.11.12
v1.11.13
v1.11.16
v1.11.5
v1.11.6
v1.11.8
v1.12.0
v1.12.1
v1.12.15
v1.12.19
v1.12.2
v1.12.21
v1.12.24
v1.12.6
v1.12.7
v1.12.9
v1.13.1
v1.13.3
v1.14.0
v1.15.3
v1.16.1
v1.16.11
v1.16.21
v1.16.3
v1.16.5
v1.17.15
v1.17.16
v1.17.19
v1.17.21
v1.17.26
v1.17.3
v1.18.0
v1.18.1
v1.18.5
v1.19.0
v1.19.5
v1.2.2
v1.20.10
v1.20.4
v1.20.6
v1.21.14
v1.21.18
v1.21.20
v1.21.34
v1.21.40
v1.21.48
v1.21.57
v1.21.73
v1.21.74
v1.21.88
v1.21.9
v1.21.91
v1.21.93
v1.22.1
v1.22.20
v1.22.24
v1.22.27
v1.22.30
v1.22.33
v1.22.8
v1.23.15
v1.23.2
v1.23.20
v1.23.22
v1.23.28
v1.23.3
v1.23.32
v1.23.4
v1.23.6
v1.23.8
v1.24.13
v1.25.10
v1.25.12
v1.25.14
v1.25.16
v1.25.20
v1.25.22
v1.25.30
v1.25.40
v1.25.41
v1.25.50
v1.25.6
v1.26.0
v1.26.1
v1.26.2
v1.27.19
v1.27.20
v1.27.30
v1.27.5
v1.28.0
v1.28.1
v1.28.3
v1.28.4
v1.29.2
v1.29.4
v1.29.5
v1.3.0
v1.3.1
v1.3.10
v1.3.12
v1.3.18
v1.3.2
v1.3.21
v1.3.25
v1.3.28
v1.3.31
v1.3.34
v1.3.36
v1.3.38
v1.3.4
v1.3.42
v1.3.45
v1.3.46
v1.3.49
v1.3.5
v1.3.55
v1.3.7
v1.3.8
v1.30.9
v1.31.1
v1.32.28
v1.32.38
v1.32.46
v1.32.6
v1.33.0
v1.33.26
v1.33.36
v1.33.6
v1.34.0
v1.34.10
v1.34.20
v1.34.26
v1.34.30
v1.34.38
v1.34.39
v1.34.46
v1.34.48
v1.34.58
v1.34.6
v1.34.68
v1.35.0
v1.35.6
v1.36.1
v1.37.1
v1.37.106
v1.37.110
v1.37.121
v1.37.126
v1.37.16
v1.37.20
v1.37.36
v1.37.38
v1.37.46
v1.37.58
v1.37.6
v1.37.60
v1.37.66
v1.37.68
v1.37.80
v1.37.88
v1.37.92
v1.37.93
v1.37.96
v1.38.11
v1.38.19
v1.38.30
v1.38.41
v1.38.42
v1.38.43
v1.38.50
v1.38.60
v1.38.65
v1.38.70
v1.38.8
v1.38.80
v1.38.81
v1.38.86
v1.39.103
v1.39.109
v1.39.119
v1.39.18
v1.39.2
v1.39.31
v1.39.35
v1.39.46
v1.39.47
v1.39.5
v1.39.56
v1.39.68
v1.39.76
v1.39.88
v1.39.99
v1.40.16
v1.40.18
v1.40.20
v1.40.6
v1.5.0
v1.5.13
v1.5.15
v1.5.18
v1.5.19
v1.5.4
v1.50.21
v1.50.40
v1.50.46
v1.50.59
v1.50.65
v1.50.66
v1.51.0
v1.51.18
v1.51.3
v1.51.8
v1.60.16
v1.60.29
v1.60.32
v1.60.36
v1.60.48
v1.60.50
v1.60.56
v1.60.6
v1.7.10
v1.7.17
v1.7.18
v1.70.0
v1.70.6
v1.72.18
v1.72.26
v1.72.36
v1.72.48
v1.72.6
v1.80.18
v1.80.2
v1.80.3
v1.80.5
v1.80.6
v1.9.12
v1.9.14
v1.9.19
v1.9.24
v1.9.27
v1.9.31
v1.9.7
v1.90.6
v1.90.8
v1.91.1
v1.91.16
v1.91.8
v2.*
v2.1.16
v2.1.26
v2.1.8
v2.10.26
v2.10.6
v2.11.16
v2.11.6
v2.12.0
v2.13.0
v2.13.6
v2.15.8
v2.16.9
v2.17.16
v2.17.8
v2.2.0
v2.3.100
v2.3.103
v2.3.113
v2.3.118
v2.3.126
v2.3.136
v2.3.151
v2.3.166
v2.3.176
v2.3.18
v2.3.181
v2.3.190
v2.3.191
v2.3.198
v2.3.30
v2.3.36
v2.3.48
v2.3.58
v2.3.6
v2.3.65
v2.3.75
v2.3.85
v2.4.28
v2.4.38
v2.5.16
v2.5.6
v2.5.9
v2.6.0
v2.7.8
v2.8.16
v2.8.6
v3.*
v3.0.18
v3.0.6
v3.1.16
v3.1.26
v3.1.6
v3.10.0
v3.11.0
v3.11.11
v3.11.12
v3.12.0
v3.15.0
v3.15.100
v3.15.110
v3.15.28
v3.15.32
v3.15.50
v3.15.58
v3.15.66
v3.15.69
v3.15.76
v3.15.86
v3.15.90
v3.2.0
v3.3.8
v3.5.6
v3.6.16
v3.6.6
v3.7.16
v3.7.18
v3.7.9
v3.8.15
v3.8.6
v3.8.8
v3.9.15
v3.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73225.json"