PT-2026-106725 · Lrzsz · Lrzsz
CVSS v4.0
7.7
عالية
| المتجه | AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
lrzsz versions prior to 0.13.0
Description
The
lrz receive utility contains a path traversal issue in its restricted mode. This occurs because the checkpath() function in src/lrz.c only filters out ../ sequences when not built with the --enable-pubdir option. Consequently, a malicious ZMODEM sender can use absolute pathnames to write files outside the intended directory and overwrite any file that the receiving user has permissions to modify.Recommendations
Update lrzsz to version 0.13.0 or later.
إصلاح
Path traversal
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Lrzsz