CVE-2026-105840
lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()
Uwe Ohse lrzsz
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 23% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.13.0lrzszCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
Text from CVE List
Affected versions 1
- lrzszaffected: all versions before 0.13.0CVE List