electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling (CVE-2026-49253)
### Impact A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses the remote-supplied filename directly in `path.join()` with the user-selected download directory without sanitization. A malicious SSH server or remote shell process can send a specially crafted filename such as `../escaped.txt` to escape the user-selected download directory and write files to arbitrary locations on the user's filesystem, subject to process permissions. **Attack scenario:** 1. User connects to a malicious SSH server 2. Attacker initiates a Zmodem or Trzsz file transfer 3. Attacker supplies a traversal filename (e.g., `../../.bashrc`, `../escaped.txt`) 4. User accepts the transfer and selects a download directory 5. File is written outside the selected directory, potentially overwriting sensitive files **Affected components:** - `src/app/server/zmodem.js` - `prepareReceiveFile()` at line 736 - `src/app/server/trzsz.js` - `getUniqueFilePath()` at line 559, `openSaveFile()` callback, and `savedFilePaths` mapping ### Patches - https://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284 ### Workarounds If upgrading is not immediately possible, users can mitigate this vulnerability by: 1. Only connecting to trusted SSH servers 2. Rejecting or canceling any incoming Zmodem or Trzsz file transfers from untrusted sources 3. Avoiding the use of Zmodem (`sz`/`rz`) and Trzsz (`trz`/`tsz`) commands on untrusted servers
AI Analysis
Technical Summary
electerm versions before 3.11.11 contain a path traversal vulnerability in the Zmodem and Trzsz file download handlers. The vulnerability arises because electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization. This allows a malicious SSH server or remote shell to send filenames containing traversal sequences (e.g., '../escaped.txt'), causing files to be written outside the intended directory. The affected code components include prepareReceiveFile() in src/app/server/zmodem.js and getUniqueFilePath() and openSaveFile() in src/app/server/trzsz.js. A patch has been committed to fix this issue.
Potential Impact
An attacker controlling a malicious SSH server or remote shell can exploit this vulnerability by sending specially crafted filenames during Zmodem or Trzsz file transfers. This can cause files to be written outside the user-selected download directory, potentially overwriting sensitive files on the user's filesystem. The impact includes integrity loss of local files and possible disruption of user environments. The vulnerability requires user interaction (accepting a file transfer) and does not affect confidentiality or availability directly.
Mitigation Recommendations
A patch fixing this vulnerability is available in electerm version 3.11.11 and later; users should upgrade to this version or newer. If immediate upgrading is not possible, users should only connect to trusted SSH servers, reject or cancel any incoming Zmodem or Trzsz file transfers from untrusted sources, and avoid using Zmodem and Trzsz commands on untrusted servers.
electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling (CVE-2026-49253)
Description
### Impact A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses the remote-supplied filename directly in `path.join()` with the user-selected download directory without sanitization. A malicious SSH server or remote shell process can send a specially crafted filename such as `../escaped.txt` to escape the user-selected download directory and write files to arbitrary locations on the user's filesystem, subject to process permissions. **Attack scenario:** 1. User connects to a malicious SSH server 2. Attacker initiates a Zmodem or Trzsz file transfer 3. Attacker supplies a traversal filename (e.g., `../../.bashrc`, `../escaped.txt`) 4. User accepts the transfer and selects a download directory 5. File is written outside the selected directory, potentially overwriting sensitive files **Affected components:** - `src/app/server/zmodem.js` - `prepareReceiveFile()` at line 736 - `src/app/server/trzsz.js` - `getUniqueFilePath()` at line 559, `openSaveFile()` callback, and `savedFilePaths` mapping ### Patches - https://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284 ### Workarounds If upgrading is not immediately possible, users can mitigate this vulnerability by: 1. Only connecting to trusted SSH servers 2. Rejecting or canceling any incoming Zmodem or Trzsz file transfers from untrusted sources 3. Avoiding the use of Zmodem (`sz`/`rz`) and Trzsz (`trz`/`tsz`) commands on untrusted servers
CVSS v3.1
Score 7.1high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
electerm versions before 3.11.11 contain a path traversal vulnerability in the Zmodem and Trzsz file download handlers. The vulnerability arises because electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization. This allows a malicious SSH server or remote shell to send filenames containing traversal sequences (e.g., '../escaped.txt'), causing files to be written outside the intended directory. The affected code components include prepareReceiveFile() in src/app/server/zmodem.js and getUniqueFilePath() and openSaveFile() in src/app/server/trzsz.js. A patch has been committed to fix this issue.
Potential Impact
An attacker controlling a malicious SSH server or remote shell can exploit this vulnerability by sending specially crafted filenames during Zmodem or Trzsz file transfers. This can cause files to be written outside the user-selected download directory, potentially overwriting sensitive files on the user's filesystem. The impact includes integrity loss of local files and possible disruption of user environments. The vulnerability requires user interaction (accepting a file transfer) and does not affect confidentiality or availability directly.
Mitigation Recommendations
A patch fixing this vulnerability is available in electerm version 3.11.11 and later; users should upgrade to this version or newer. If immediate upgrading is not possible, users should only connect to trusted SSH servers, reject or cancel any incoming Zmodem or Trzsz file transfers from untrusted sources, and avoid using Zmodem and Trzsz commands on untrusted servers.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-38j7-23hf-9mhc
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49253"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a46ecba27e9c7971943cda0
Added to database: 07/02/2026, 22:56:58 UTC
Last enriched: 07/02/2026, 23:13:48 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.