Skip to content
OpenAdvisories
High RHSA-2026:98481 2 CVEs

Red Hat Security Advisory: lrzsz security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::baseos lrzsz 0:0.12.20-58.el9_9
Red Hat · RHEL 9 enterprise_linux:9::baseos lrzsz-debuginfo 0:0.12.20-58.el9_9
Red Hat · RHEL 9 enterprise_linux:9::baseos lrzsz-debugsource 0:0.12.20-58.el9_9

Vulnerabilities 2

  • High 7.5
    CVE-2026-105840

    lrzsz before 0.13.0 Path Traversal via lrz Restricted Mode checkpath()

    lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects …

    Uwe Ohse lrzsz lrzsz lrzsz Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-105841

    lrzsz before 0.13.0 OS Command Injection via lrz Pipe Mode

    lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lr…

    Uwe Ohse lrzsz lrzsz lrzsz Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2546590
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2546595
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98481.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-105840
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-105840
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-105840
  • article
    https://ohse.de/uwe/software/lrzsz.html
  • article
    https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html
  • article
    https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-path-traversal-via-lrz-restricted-mode-checkpath
  • report
    https://access.redhat.com/security/cve/CVE-2026-105841
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-105841
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-105841
  • article
    https://www.vulncheck.com/advisories/lrzsz-before-0.13.0-os-command-injection-via-lrz-pipe-mode