CVE-2026-105840

Summary

The lrzsz library contains a path traversal vulnerability in its receive utility that allows attackers to write files outside the intended directory using absolute paths. This can lead to arbitrary file overwrite and potentially system compromise.

Exploitability

Exploitation requires a malicious ZMODEM sender to initiate a transfer with absolute paths, but is relatively straightforward once the vulnerable lrz utility is in use.

Blast radius

The vulnerability could affect any system running lrzsz version before 0.13.0 where users can receive ZMODEM transfers, potentially allowing attackers to overwrite critical system files or configuration data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to lrzsz version 0.13.0 or later to fix the path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.