CVE-2026-105841

Name of the Vulnerable Software and Affected Versions lrzsz versions prior to 0.13.0

Description The lrz receive utility contains an OS command injection flaw in its pipe mode. This occurs when lrz is executed under a suffixed name, such as lrztar, causing the procheader() function in src/lrz.c to pass an unescaped ZMODEM or YMODEM filename directly to popen(). Consequently, a remote sender can execute arbitrary commands as the receiving user by providing a specially crafted filename containing shell metacharacters.

Recommendations Update lrzsz to version 0.13.0 or later.