Path Traversal Vulnerability in Electerm Client by Electerm

CVE-2026-49253

What is CVE-2026-49253?

The Electerm Client, an open-source terminal and communication tool, incorporates a vulnerability that allows remote attackers to exploit file transfer operations. Specifically, versions prior to 3.11.11 fail to properly sanitize filenames received during Zmodem and Trzsz file transfers. This oversight enables malicious servers to manipulate file paths, potentially allowing them to write files outside of designated directories. As a result, sensitive configuration files could be overwritten, leading to potential security breaches or system unavailability. Users are urged to update to version 3.11.11 to mitigate this risk.

References