CVE-2026-105840: lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lrzszto a version that resolves this vulnerability.Fixed in 0.13.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running the lrz receive utility in restricted mode are exposed when they receive ZMODEM files from a malicious sender. The sender does not need prior privileges, but must be able to initiate or participate in a ZMODEM transfer and induce the user to receive the file.
What can an attacker do?
A malicious sender can use an absolute pathname as the received filename to write outside the current directory. This can overwrite files that are writable by the user running lrz.
Are all restricted-mode builds affected?
The described checkpath() behavior affects versions before 0.13.0 unless lrzsz was built with --enable-pubdir. In the affected build behavior, checkpath() rejects '../' sequences but does not reject absolute pathnames.
What should be done if an upgrade is not immediately possible?
Do not receive ZMODEM transfers from untrusted senders, especially while lrz is running under an account that can write to sensitive files. Restrict the receiving account's filesystem permissions to limit the impact of arbitrary file writes.