This CVE exposes a path traversal vulnerability in electerm's recursive SFTP/FTP download logic. The core issue is that electerm passes server-supplied file and folder names directly to Node's resolve() function without validating containment bounds. In recursive transfers, the client follows whatever directory structure the server advertises—meaning a malicious or compromised server can instruct the client to write files outside the intended download directory using path traversal sequences in the server's responses.
The CVSS 8.1 reflects the technical severity, but the actual risk is amplified by electerm's user base: infrastructure workers who SSH into production systems, manage cloud environments, and maintain jump host relationships. A path traversal on a developer's laptop exposes home directory contents. The same vulnerability on an infrastructure worker's client can expose SSH keys, config files, and credential caches that lead to production systems.
Your immediate actions: First, verify what version you're running—3.15.120 contains the patch. Second, and more importantly, examine the patch implementation itself. The fix must enforce containment bounds by resolving the final path and verifying it starts with the download root directory, not merely strip ".." sequences. Character sanitization is brittle and will be bypassed through encoding tricks, Unicode normalization, or path separator variations. If the patch only filters traversal characters without enforcing a hard containment boundary, treat this as a temporary measure and monitor closely.
Third, audit your other transfer mechanisms. The same trust misidentification—treating the server as a cooperative partner rather than an untrusted input source—may exist in RDP, VNC, or Spice file transfer code within electerm. Check whether recursive operations in those modules handle server-supplied paths with the same assumption. Even deprecated or unused transfer modes in the codebase carry risk if they can be triggered or if their code patterns were copied into active features.
The EPSS score of 0.00311 likely understates active exploitation. Infrastructure workers connecting to compromised servers, third-party hosting, or CTF environments may have already been exploited without recognizing it—the client just writes files where it shouldn't, and users typically blame themselves rather than their client software.