{"id":"CVE-2026-105841","aliases":["ALSA-2026:83525","ALSA-2026:86056","ALSA-2026:89755","AZL-106673","CLSA-2026-1792053113","CLSA-2026-1792422501","CLSA-2026-1792503867","DEBIAN-CVE-2026-105841","EUVD-2026-93393","GHSA-w9c3-4vq7-c452","RHSA-2026:83525","RLSA-2026:83525","RLSA-2026:86056","RLSA-2026:89755","RLSA-2026:98481","UBUNTU-CVE-2026-105841"],"status":"published","title":"lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00935,"percentile":0.61258,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-10-06T13:35:46Z","modified":"2026-11-12T00:30:02Z","fixes":[{"ecosystem":"Debian:14","package":"lrzsz","fixed_in":["0.13.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-69.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-58.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.12.20-50"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-55.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.21-10~build0.18.04.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.20-55.el9_6.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10","0.12.21-11","0.12.21rc-0.1","0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5","0.13.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5","0.13.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-3","0.12.21rc-4","0.12.21rc-5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lrzsz-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"lrzsz-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-46.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-69.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-58.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.20-58.el9_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-5","0.12.21-7","0.12.21-10~build0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-8","0.12.21-10~build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-8","0.12.21-8build1","0.12.21-10~build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21-10","0.12.21-11","0.12.21-11build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.3","0.12.21rc-1","0.12.21rc-2","0.12.21rc-4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lrzsz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.21rc-0.2","0.12.21rc-0.3"]}],"products":[{"vendor":"microsoft","product":"lrzsz"},{"vendor":"uwe ohse","product":"lrzsz"}],"references":[{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","tags":["vendor-advisory","article","report"]},{"url":"https://ohse.de/uwe/software/lrzsz.html","tags":["product","article"]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode","tags":["third-party-advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105841","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w9c3-4vq7-c452"},{"url":"https://access.redhat.com/errata/RHSA-2026:83525","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105840","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-105841","tags":["report"]},{"url":"https://bugzilla.redhat.com/2546590","tags":["report"]},{"url":"https://bugzilla.redhat.com/2546595","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-83525.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:86056","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-86056.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:89755","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-89755.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792053113.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105842","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792422501.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792503867.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-105841","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546590","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546595","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83525.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105840","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-path-traversal-via-lrz-restricted-mode-checkpath","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105841","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2026:83525","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:86056","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:89755","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98481","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98481","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-105841","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-105841","title":"lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T13:35:46.9Z","modified":"2026-10-06T13:58:44.875Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-93393","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T13:35:46Z","modified":"2026-10-06T13:58:44Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:37.480805Z"}],"ghsa":[{"id":"GHSA-w9c3-4vq7-c452","title":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's...","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T15:31:59Z","modified":"2026-10-06T15:32:06Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:12:51.459076Z"}],"nvd":[{"id":"CVE-2026-105841","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T14:17:41.46Z","modified":"2026-10-06T15:25:00.65Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:12:54.486849Z"}],"osv":[{"id":"DEBIAN-CVE-2026-105841","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T14:17:41.46Z","modified":"2026-10-18T04:00:07.075526606Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.903138Z"},{"id":"RHSA-2026:83525","title":"Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update","status":"published","published":"2026-10-16T10:27:25Z","modified":"2026-10-16T10:31:32.9599892Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:83525","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-16T12:01:11.43223Z","modified":"2026-10-16T12:45:02.667044901Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:86056","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-10.2.z] (JIRA:Rocky Linux-282106)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-22T00:09:05.434592Z","modified":"2026-10-22T00:30:03.407917846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:89755","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-9.8.z] (JIRA:Rocky Linux-282108)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-27T12:04:59.651604Z","modified":"2026-10-27T12:30:04.534166242Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.76659Z"},{"id":"RLSA-2026:98481","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.\n\nSecurity Fix(es):\n\n* lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n\n* lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\nBug Fix(es) and Enhancement(s):\n\n* lrzsz: segfault with -s [rhel-9.9.z] (JIRA:Rocky Linux-282118)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-12T00:04:47.087081Z","modified":"2026-11-12T00:30:02.519190782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-12T00:54:50.801358Z"},{"id":"UBUNTU-CVE-2026-105841","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T14:17:00Z","modified":"2026-10-17T12:58:43.603110049Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"ALSA-2026:83525","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.  \n\nSecurity Fix(es):  \n\n  * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n  * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * lrzsz: segfault with -s [almalinux-8.10.z] (JIRA:AlmaLinux-282148)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-29T11:02:24.857215246Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:86056","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.  \n\nSecurity Fix(es):  \n\n  * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n  * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * lrzsz: segfault with -s [almalinux-10.2.z] (JIRA:AlmaLinux-282106)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-29T11:31:01.199448456Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"ALSA-2026:89755","title":"Important: lrzsz security, bug fix, and enhancement update","description":"Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.  \n\nSecurity Fix(es):  \n\n  * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)\n  * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * lrzsz: segfault with -s [almalinux-9.8.z] (JIRA:AlmaLinux-282108)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-26T00:00:00Z","modified":"2026-10-29T11:32:32.849748866Z","updated_at":"2026-11-02T15:27:57.367731Z"},{"id":"AZL-106673","title":"CVE-2026-105841 affecting package lrzsz 0.12.20-50","description":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.","status":"published","published":"2026-10-06T14:17:41Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:17.969374Z"},{"id":"CLSA-2026-1792053113","title":"lrzsz: Fix of 3 CVEs","description":"- CVE-2026-105840: lrz: reject absolute and escaping paths in restricted mode\n- CVE-2026-105841: lrz: remove piping received files to a shell command\n- CVE-2026-105842: lrz: terminate received data and bound file name length","status":"published","published":"2026-10-15T08:32:03Z","modified":"2026-10-26T09:30:39.105423301Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792422501","title":"Fix CVE(s): CVE-2026-105840, CVE-2026-105841, CVE-2026-105842","description":"   * SECURITY UPDATE: absolute path names accepted in restricted mode\n     - debian/patches/CVE-2026-105840.patch: reject absolute path names in\n       restricted mode in checkpath() in src/lrz.c and wcs() in src/lsz.c,\n       not only in PUBDIR builds\n     - CVE-2026-105840\n   * SECURITY UPDATE: command injection via the pipe mode\n     - debian/patches/CVE-2026-105841.patch: remove the pipe mode that ran\n       received files through a shell command when lrz was invoked as\n       rzCOMMAND, in src/lrz.c\n     - CVE-2026-105841\n   * SECURITY UPDATE: heap buffer overflow via a long file name\n     - debian/patches/CVE-2026-105842.patch: allocate the received path name\n       with strdup() instead of a fixed PATH_MAX*2 buffer, and NUL-terminate\n       the ZFILE subpacket, in src/lrz.c\n     - CVE-2026-105842","status":"published","published":"2026-10-19T15:08:34Z","modified":"2026-10-26T09:32:04.524825449Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792503867","title":"lrzsz: Fix of 3 CVEs","description":"- CVE-2026-105840: reject absolute path names in restricted mode in lrz\n  (received files) and lsz (sent files), not only in PUBDIR builds\n- CVE-2026-105841: remove the pipe mode that ran received files through a\n  shell command when lrz was invoked as rzCOMMAND\n- CVE-2026-105842: allocate the received path name with strdup() instead of\n  a fixed PATH_MAX*2 buffer, and NUL-terminate the ZFILE subpacket","status":"published","published":"2026-10-20T13:44:39Z","modified":"2026-10-26T09:31:19.959426553Z","updated_at":"2026-11-02T15:43:54.378946Z"}]}}