Description
Directory traversal vulnerability in ZNC before 0.072 allows remote attackers to overwrite arbitrary files via a crafted DCC SEND request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | znc | 0.074-1 | — |
| Debian 13 | znc | 0.074-1 | — |
| Debian 12 | znc | 0.074-1 | — |
| Debian 5.0 | znc | 0.058-2+lenny3 | DSA-1848-1 |
| Debian 4.0 | znc | 0.045-3+etch3 | DSA-1848-1 |
Advisories 1
- DSA-1848-1 znc - directory traversal Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://en.znc.in/w/index.php?title=ZNC&oldid=3209#WARNING
- [oss-security] 20090721 CVE Request -- znc mailing-list
- FEDORA-2009-7937 vendor-advisory
- http://znc.svn.sourceforge.net/viewvc/znc?view=rev&sortby=rev&sortdir=down&revision=1570
- http://en.znc.in/wiki/ChangeLog/0.072
- 35916 third-party-advisory
- DSA-1848 vendor-advisory