CVE-2026-49253

Summary

electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling

Severity

high

CVSS

7.1

EPSS

0.4% (p32)

CWE

CWE-22

Also known as

GHSA-38j7-23hf-9mhc

Published

2026-07-02

Updated

2026-07-02

Advisory details

Impact

A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization.

A malicious SSH server or remote shell process can send a specially crafted filename such as ../escaped.txt to escape the user-selected download directory and write files to arbitrary locations on the user's filesystem, subject to process permissions.

Attack scenario:

1. User connects to a malicious SSH server
2. Attacker initiates a Zmodem or Trzsz file transfer
3. Attacker supplies a traversal filename (e.g., ../../.bashrc, ../escaped.txt)
4. User accepts the transfer and selects a download directory
5. File is written outside the selected directory, potentially overwriting sensitive files

Affected components:

• src/app/server/zmodem.js - prepareReceiveFile() at line 736
• src/app/server/trzsz.js - getUniqueFilePath() at line 559, openSaveFile() callback, and savedFilePaths mapping

Patches

• https://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284

Workarounds

If upgrading is not immediately possible, users can mitigate this vulnerability by:

1. Only connecting to trusted SSH servers
2. Rejecting or canceling any incoming Zmodem or Trzsz file transfers from untrusted sources
3. Avoiding the use of Zmodem (sz/rz) and Trzsz (trz/tsz) commands on untrusted servers

References

• https://github.com/advisories/GHSA-38j7-23hf-9mhc
• https://github.com/electerm/electerm/security/advisories/GHSA-38j7-23hf-9mhc
• https://github.com/electerm/electerm/commit/fde153d677a170c5816368f6586647f3af4ef284

Related advisories

• CVE-2026-49255 — high · npm/electerm
• CVE-2026-75604 — critical · npm/next
• CVE-2026-65600 — critical · Go/github.com/traefik/traefik/v2
• CVE-2026-67429 — critical · PyPI/flyto-core
• CVE-2026-59864 — critical · NuGet/Microsoft.OpenApi.Kiota
• GHSA-p63j-vcc4-9vmv — critical · npm/@vitest/browser
• GHSA-hgjx-r89m-m7v4 — critical · Packagist/facturascripts/facturascripts
• CVE-2026-50006 — critical · Go/github.com/julien040/anyquery

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity