CVE-2026-49253

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile joins the filename to the...

CVE-2026-49253

In electerm versions prior to 3.11.11, path.join() in prepareReceiveFile() (zmodem.js) and getUniqueFilePath()/openSaveFile() (trzsz.js) accepts remote-supplied filenames without sanitization, allowing a malicious SSH server to write files outside the download directory using ../ sequences. Fixed...