CVE-2026-73224: Electerm check folder size function may get attacked by unsafe folder name
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
electermto a version that resolves this vulnerability.Fixed in 3.15.120
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73224?
The severity of CVE-2026-73224 is high, with a CVSS score of 8.8.
How does CVE-2026-73224 affect Electerm?
CVE-2026-73224 allows malicious FTP or SFTP servers to execute arbitrary commands on user systems through unsafe folder names.
How can I fix CVE-2026-73224?
To fix CVE-2026-73224, update Electerm to version 3.15.120 or later.
What types of attacks are possible with CVE-2026-73224?
CVE-2026-73224 could lead to OS command injection attacks when users download crafted folders from compromised FTP or SFTP servers.
What versions of Electerm are affected by CVE-2026-73224?
Versions of Electerm prior to 3.15.120 are affected by CVE-2026-73224.