lrzsz vulnerabilities

2 known vulnerabilities in lrzsz from Uwe Ohse. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  lrzsz: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-105841Oct 6, 2026Uwe Ohse

  lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz

• 7.5 High severity

  lrzsz: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-105840Oct 6, 2026Uwe Ohse

  lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '