{"id":"CVE-2026-105840","aliases":["ALSA-2026:83525","ALSA-2026:86056","ALSA-2026:89755","AZL-106667","CLSA-2026-1792053113","CLSA-2026-1792422501","CLSA-2026-1792503867","DEBIAN-CVE-2026-105840","EUVD-2026-93392","GHSA-3hwf-cvfh-5874","RHSA-2026:83525","RLSA-2026:83525","RLSA-2026:86056","RLSA-2026:89755","RLSA-2026:98481","UBUNTU-CVE-2026-105840"],"status":"published","title":"lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00313,"percentile":0.24599,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-10-06T13:35:46Z","modified":"2026-11-12T00:30:02Z","fixes":[{"ecosystem":"Debian:14","package":"lrzsz","fixed_in":["0.12.21rc-5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-69.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-58.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.20-50"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-55.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10~build0.18.04.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-55.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10","0.12.21-11","0.12.21rc-0.1","0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5","0.13.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5","0.13.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21rc-5"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lrzsz-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lrzsz-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-69.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-58.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-58.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-5","0.12.21-7","0.12.21-10~build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-8","0.12.21-10~build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-8","0.12.21-8build1","0.12.21-10~build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10","0.12.21-11","0.12.21-11build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3"]}],"products":[{"vendor":"microsoft","product":"lrzsz"},{"vendor":"uwe ohse","product":"lrzsz"}],"references":[{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","tags":["vendor-advisory","article","report"]},{"url":"https://ohse.de/uwe/software/lrzsz.html","tags":["product","article"]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-path-traversal-via-lrz-restricted-mode-checkpath","tags":["third-party-advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105840","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3hwf-cvfh-5874"},{"url":"https://access.redhat.com/errata/RHSA-2026:83525","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105840","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105841","tags":["report"]},{"url":"https://bugzilla.redhat.com/2546590","tags":["report"]},{"url":"https://bugzilla.redhat.com/2546595","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-83525.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86056","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-86056.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89755","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-89755.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792053113.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105841","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105842","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792422501.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792503867.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105840","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546595","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83525.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105840","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105841","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83525","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86056","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89755","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98481","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98481","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-105840","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-105840","title":"lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T13:35:46.072Z","modified":"2026-10-09T00:59:56.28Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-93392","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T13:35:46Z","modified":"2026-10-09T00:59:56Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:25.942984Z"}],"ghsa":[{"id":"GHSA-3hwf-cvfh-5874","title":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's...","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T15:31:58Z","modified":"2026-10-06T15:31:58Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:12:50.930323Z"}],"nvd":[{"id":"CVE-2026-105840","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T14:17:41.3Z","modified":"2026-10-09T02:16:55.51Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"DEBIAN-CVE-2026-105840","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T14:17:41.3Z","modified":"2026-10-13T08:00:06.638537673Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"RHSA-2026:83525","title":"Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update","status":"published","published":"2026-10-16T10:27:25Z","modified":"2026-10-16T10:31:32.9599892Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:83525","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:01:11.43223Z","modified":"2026-10-16T12:45:02.667044901Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:86056","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-10.2.z] (JIRA:Rocky Linux-282106)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:09:05.434592Z","modified":"2026-10-22T00:30:03.407917846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89755","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-9.8.z] (JIRA:Rocky Linux-282108)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:04:59.651604Z","modified":"2026-10-27T12:30:04.534166242Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:98481","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-9.9.z] (JIRA:Rocky Linux-282118)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:47.087081Z","modified":"2026-11-12T00:30:02.519190782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-105840","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T14:17:00Z","modified":"2026-10-17T12:59:46.800977754Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:83525","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.  \n\nSecurity Fix(es):  \n\n  * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n  * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * lrzsz: segfault with -s [almalinux-8.10.z] (JIRA:AlmaLinux-282148)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:02:24.857215246Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:86056","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.  \n\nSecurity Fix(es):  \n\n  * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n  * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * lrzsz: segfault with -s [almalinux-10.2.z] (JIRA:AlmaLinux-282106)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:31:01.199448456Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89755","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.  \n\nSecurity Fix(es):  \n\n  * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n  * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * lrzsz: segfault with -s [almalinux-9.8.z] (JIRA:AlmaLinux-282108)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.849748866Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-106667","title":"CVE-2026-105840 affecting package lrzsz 0.12.20-50","description":"lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.","status":"published","published":"2026-10-06T14:17:41Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"CLSA-2026-1792053113","title":"lrzsz: Fix of 3 CVEs","description":"- CVE-2026-105840: lrz: reject absolute and escaping paths in restricted mode\n- CVE-2026-105841: lrz: remove piping received files to a shell command\n- CVE-2026-105842: lrz: terminate received data and bound file name length","status":"published","published":"2026-10-15T08:32:03Z","modified":"2026-10-26T09:30:39.105423301Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792422501","title":"Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842","description":"   * SECURITY UPDATE: absolute path names accepted in restricted mode\n     - debian/patches/CVE-2026-105840.patch: reject absolute path names in\n       restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c,\n       not only in PUBDIR builds\n     - CVE-2026-105840\n   * SECURITY UPDATE: command injection via the pipe mode\n     - debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran\n       received files through a shell command when lrz was invoked as\n       rzCOMMAND, in src/lrz.c\n     - CVE-2026-105841\n   * SECURITY UPDATE: heap buffer overflow via a long file name\n     - debian/patches/CVE-2026-105842.patch: allocate the received path name\n       with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate\n       the ZFILE subpacket, in src/lrz.c\n     - CVE-2026-105842","status":"published","published":"2026-10-19T15:08:34Z","modified":"2026-10-26T09:32:04.524825449Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792503867","title":"lrzsz: Fix of 3 CVEs","description":"- CVE-2026-105840: reject absolute path names in restricted mode in lrz\n  (received files) and lsz (sent files), not only in PUBDIR builds\n- CVE-2026-105841: remove the pipe mode that ran received files through a\n  shell command when lrz was invoked as rzCOMMAND\n- CVE-2026-105842: allocate the received path name with strdup() instead of\n  a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket","status":"published","published":"2026-10-20T13:44:39Z","modified":"2026-10-26T09:31:19.959426553Z","updated_at":"2026-11-02T15:43:54.378946Z"}]}}