Red Hat Security Advisory

RHSA-2026:89755

lrzsz security, bug fix, and enhancement update

Released 2026-10-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 9) lrzsz-0.12.20-58.el9_8

Fixes 2 records

TI-2026-68424 CVE-2026-105841 · GHSA-w9c3-4vq7-c452

OS command injection in lrzsz lrz pipe mode

LOW 37

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00935 Published 2026-10-06 Partial fix · 0.13.0 CWE-78

TI-2026-68423 CVE-2026-105840 · GHSA-3hwf-cvfh-5874

Path traversal in lrzsz lrz restricted mode lets senders overwrite files

LOW 35

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00313 Published 2026-10-06 Partial fix · 0.13.0 CWE-22