CVE-2026-129119: C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND
C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
C-Kermit versions from 6.0.192 through versions before 11.1.515 are identified as affected. The issue is relevant where C-Kermit receives files from potentially malicious or untrusted senders.
What does an attacker need to do to exploit it?
An attacker needs to send a file transfer marked as RESEND. This causes the receiver to append data to an existing file rather than reject the collision, without showing a RECEIVE CONFIRM prompt.
What is the practical impact of successful exploitation?
A malicious sender can append content to files that already exist on the receiving system. The advisory specifically notes that this can be used to modify shell startup files, potentially affecting commands run by a user.
Is user interaction required?
The supplied severity vector indicates user interaction is required. However, the described RESEND handling bypasses the RECEIVE CONFIRM prompt, so the receiver is not prompted to approve the overwrite-or-append behavior.
What version addresses the issue?
The affected range ends before C-Kermit 11.1.515, indicating that version 11.1.515 addresses the issue.