electerm versions before 3.11.11 contain a path traversal vulnerability in the Zmodem and Trzsz file download handlers. The vulnerability arises because electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization. This allows a malicious SSH server or remote shell to send filenames containing traversal sequences (e.g., '../escaped.txt'), causing files to be written outside the intended directory. The affected code components include prepareReceiveFile() in src/app/server/zmodem.js and getUniqueFilePath() and openSaveFile() in src/app/server/trzsz.js. A patch has been committed to fix this issue.

An attacker controlling a malicious SSH server or remote shell can exploit this vulnerability by sending specially crafted filenames during Zmodem or Trzsz file transfers. This can cause files to be written outside the user-selected download directory, potentially overwriting sensitive files on the user's filesystem. The impact includes integrity loss of local files and possible disruption of user environments. The vulnerability requires user interaction (accepting a file transfer) and does not affect confidentiality or availability directly.

A patch fixing this vulnerability is available in electerm version 3.11.11 and later; users should upgrade to this version or newer. If immediate upgrading is not possible, users should only connect to trusted SSH servers, reject or cancel any incoming Zmodem or Trzsz file transfers from untrusted sources, and avoid using Zmodem and Trzsz commands on untrusted servers.