CVE-2026-129121: C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE
C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of C-Kermit versions 8.0.200 before 11.1.515 are exposed when they use MGET or RECURSIVE operations against an FTP server that can supply malicious NLST or MLSD listing entries.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to influence listings returned by, the FTP server used by the vulnerable C-Kermit client. The malicious listing must include an absolute path, a tilde-prefixed name, or dot-dot path components.
What is the impact of successful exploitation?
A malicious FTP server can cause files to be written outside C-Kermit's intended download directory. This can overwrite files such as .bashrc and may lead to code execution.
What should be done if patching cannot happen immediately?
Avoid using MGET or RECURSIVE against untrusted FTP servers, especially where server-controlled NLST or MLSD listings could contain path-like filenames. Restrict transfers to trusted servers until an update is available.
How can I determine whether I am affected?
Check the installed C-Kermit version. Versions from 8.0.200 through versions before 11.1.515 are affected; version 11.1.515 is the referenced fixed release.