CVE-2026-49253

In electerm versions prior to 3.11.11, path.join() in prepareReceiveFile() (zmodem.js) and getUniqueFilePath()/openSaveFile() (trzsz.js) accepts remote-supplied filenames without sanitization, allowing a malicious SSH server to write files outside the download directory using ../ sequences. Fixed...