Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by VulnCheck

CVE-2026-105840lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

High 7.5

In plain English

A high-severity path traversal in lrzsz from Uwe Ohse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 75.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10lrzsz0.12.20-69.el10_2ALSA-2026:86056
AlmaLinux:8lrzsz0.12.20-46.el8_10ALSA-2026:83525
AlmaLinux:9lrzsz0.12.20-58.el9_8ALSA-2026:89755
Debian:12lrzszno fix listedDEBIAN-CVE-2026-105840
Debian:13lrzszno fix listedDEBIAN-CVE-2026-105840
Debian:14lrzsz0.12.21rc-5DEBIAN-CVE-2026-105840
Rocky Linux:10lrzsz0:0.12.20-69.el10_2RLSA-2026:86056
Rocky Linux:8lrzsz0:0.12.20-46.el8_10RLSA-2026:83525
Rocky Linux:9lrzsz0:0.12.20-58.el9_8RLSA-2026:89755
Ubuntu:22.04:LTSlrzszno fix listedUBUNTU-CVE-2026-105840
Ubuntu:24.04:LTSlrzszno fix listedUBUNTU-CVE-2026-105840
Ubuntu:26.04:LTSlrzszno fix listedUBUNTU-CVE-2026-105840
Ubuntu:26.10lrzszno fix listedUBUNTU-CVE-2026-105840

Affected products (as reported)

VendorProductVersions
Uwe Ohse lrzsz 0 – before 0.13.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References