CVE-2026-49253: electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling

A path traversal vulnerability exists in the Zmodem and Trzsz file download handlers in electerm. When receiving files via Zmodem or Trzsz protocols, electerm uses the remote-supplied filename directly in path.join() with the user-selected download directory without sanitization.

A malicious SSH server or remote shell process can send a specially crafted filename such as ../escaped.txt to escape the user-selected download directory and write files to arbitrary locations on the user’s filesystem, subject to process permissions.

Attack scenario:

1. User connects to a malicious SSH server
2. Attacker initiates a Zmodem or Trzsz file transfer
3. Attacker supplies a traversal filename (e.g., ../../.bashrc, ../escaped.txt)
4. User accepts the transfer and selects a download directory
5. File is written outside the selected directory, potentially overwriting sensitive files

Affected components:

• src/app/server/zmodem.js - prepareReceiveFile() at line 736
• src/app/server/trzsz.js - getUniqueFilePath() at line 559, openSaveFile() callback, and savedFilePaths mapping