## Summary
electerm versions prior to 3.15.120 allow a malicious remote FTP/SFTP server to write attacker-controlled content outside the user-selected download directory during recursive transfers. This is due to unsanitized use of server-supplied file.name and folder.name in path resolution, enabling path traversal and arbitrary file write.
## Technical Details
- Root cause: recursive transfer destination paths are computed using resolve(toPath, file.name) and resolve(toPath, folder.name) without sanitization.
- Attack technique: a malicious server returns crafted directory entries such as ../../.bashrc (or similar), causing the resolved destination to escape the intended download directory.
- Code-level fix: the patch introduces sanitizeFilename and applies it to both file and folder names before calling resolve().
- toItemPath = resolve(toPath, sanitizeFilename(file.name))
- toItemPath = resolve(toPath, sanitizeFilename(folder.name))
## Affected
- electerm prior to 3.15.120 (recursive folder download via FTP/SFTP)
## Impact
- Arbitrary file write outside the selected download directory.
- Potential code execution if written content is placed into sensitive locations (e.g., user startup/config files), as described in the advisory.
- Attack prerequisites: user interaction is required (UI:R), but the malicious server can be reached over the network (AV:N) without prior authentication (PR:N).
## Mitigation
1. Upgrade electerm to 3.15.120 or later (fix commit deee11ffe558eaee5cad5822949ba3a7f87ae56a).
2. If upgrading is not immediately possible, avoid recursive downloads from untrusted FTP/SFTP servers (no workaround is provided in the advisory).
3. Monitor for unexpected files written outside the intended download directory after FTP/SFTP recursive transfers (e.g., presence of traversal-named artifacts or modifications to user dotfiles).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CWE-22