HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-105840 — lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive u...

·Source: NIST NVD

Updated:

Executive Summary

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the r

Analysis

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user. CVSS Score: 7.5. Published: 2026-10-06T14:17:41.300.

Indicators of Compromise (1)

CVE (1)
CVE-2026-105840
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 6, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Bahrain central bank to treble tech budget

The Central Bank of Bahrain (CBB) plans to increase its investment in technology by threefold over the next three years as part of a plan to develop Bahrain to the region's primary banking hub.

Finextra
MEDIUMVulnerabilityNEW

Microsoft: Windows 11 23H2 reaches end of support in 30 days

Microsoft has reminded customers that systems running Windows 11 23H2 Enterprise, Education, and IoT Enterprise editions will stop receiving security updates next month. [...]

BleepingComputer
MEDIUMVulnerabilityNEW

Major French Supermarket Chains Hit by Cyber-Attack, Food Stock Impacted

The CEO of Cooperative U confirmed a cyber-attack affected the food stock in several stores from October 11

Infosecurity Magazine