CVE-2026-73227 exposes a trust inversion in electerm's RDP clipboard transfer: the server-supplied filename from the CLIPRDR protocol (fileInfo.name) is passed directly to filesystem operations without sanitization. This allows a malicious RDP server to write arbitrary files to your local filesystem via path traversal — the server pushes a filename containing ../ sequences, and electerm writes it to your chosen download directory without validation.
The vulnerability isn't a novel attack surface — it's path traversal wearing an RDP wrapper, the same vulnerability class that's surfaced in terminal emulators, file transfer clients, and web applications across three decades. What makes this instance dangerous is the blast radius: electerm users are disproportionately sysadmins, DevOps engineers, and developers whose client machines hold SSH keys, VPN configs, and credentials for the infrastructure they're managing. An adversarial RDP server doesn't just write a text file — it can plant scheduled tasks, startup scripts, or modified dotfiles that persist across sessions, creating a reverse pivot vector that turns your own RDP session against you.
The patch in version 3.15.120 presumably adds sanitization, but ask whether it uses basename extraction, path canonicalization with bounds checking, or directory restriction — and whether that approach is applied consistently across all file-handling paths. More importantly, treat this as the first discovered instance of a pattern, not a one-off bug. The architectural assumption that server-supplied metadata can be used directly in filesystem operations likely exists elsewhere: audit SFTP, FTP, and other protocol handlers for the same trust inversion. Document that electerm now assumes servers are potentially malicious, and add a code review checklist item for server-controlled input in file operations. The CVSS 8.1 score understates the systemic risk because it measures the vulnerability in isolation, not the lateral movement cascade it enables.