Arbitrary file write via unsanitized server filenames

Path traversal in electerm before 3.15.120 allows remote attackers to write files outside a chosen directory during recursive downloads. The shared transfer.jsx code passes raw FTP or SFTP file.name and folder.name values to resolve when constructing local destination paths. Exploitation requires a user to initiate a recursive download from an attacker-controlled server; the resulting write can overwrite user-writable files and lead to code execution.