{"id":"CVE-2026-105841","title":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames","summary":"lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"Uwe Ohse","product":"lrzsz","affected":["lrzsz < 0.13.0"],"published":"2026-10-06","updated":"2026-10-06","sourceUpdated":"2026-10-06T15:25:00.650","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-105841","references":[{"url":"https://ohse.de/uwe/software/lrzsz.html","label":"disclosure@vulncheck.com"},{"url":"https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105841.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-105841"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546595"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-105841"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105841"},{"url":"https://access.redhat.com/errata/RHSA-2026:83525"},{"url":"https://access.redhat.com/errata/RHSA-2026:86056"},{"url":"https://access.redhat.com/errata/RHSA-2026:89755"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-06T13:56:33.353808Z"},"ingestedAt":"2026-10-06T14:00:19.148Z","epss":0.00935,"epssPercentile":0.60601,"patched":["enterprise_linux_baseos_v_8"],"slug":"CVE-2026-105841","body":"## Overview\n\nlrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 7 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105841.json)\n- **RHSA-2026:83525** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-10-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:83525)\n- **RHSA-2026:86056** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86056)\n- **RHSA-2026:89755** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-10-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:89755)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}