CVE-2026-49253 is a path traversal in electerm's Zmodem and Trzsz file transfer handlers. A malicious SSH server can send a filename containing "../" sequences to write files outside the user-selected download directory. The root cause isn't missing input sanitization—it's the use of path.join() as if it provided containment guarantees it structurally cannot deliver.
When you call path.join('/user/chosen/dir', '../../../etc/passwd'), the result is /etc/passwd. The function normalizes separators and resolves ".." segments, but it performs no directory containment checking. Developers consistently treat path.join() as a security boundary rather than a string utility, and the function's name actively encourages this misinterpretation. This pattern has appeared in dozens of Node.js CVEs over the past decade.
What matters now is whether the 3.11.11 fix addresses the actual vulnerability or just its symptoms. There are two fundamentally different approaches: stripping ".." sequences from the incoming filename (fragile, easy to bypass with encoding tricks or symlinks), or verifying that the resolved destination path actually stays within the user-selected directory (robust). If the commit only does the former, expect another CVE in 12-18 months when someone finds the bypass.
For defenders: check your electerm version, upgrade to 3.11.11 or later, and verify the fix by attempting a transfer with a filename like "../../../tmp/test.txt"—it should either reject the filename or correctly place the file inside your chosen directory. More broadly, treat any use of path.join() with untrusted input as a potential traversal vector. The correct pattern is resolving the final path and asserting it starts with your allowed directory prefix before any file operation.