lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2168:02 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
      * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)     Bug Fix(es) and Enhancement(s):
      * lrzsz: segfault with -s [rhel-9.8.z] (JIRA:RHEL-282108)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:89755 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-9.8.z] (JIRA:Rocky Linux-282108)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-89755 advisory.

    - Backport tightened path handling from 0.13.1 (CVE-2026-105840)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:89755 advisory.

    Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the     public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem     solution for Linux systems.

    Security Fix(es):

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-9.8.z] (JIRA:RHEL-282108)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_86056 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-10.2.z] (JIRA:Rocky Linux-282106)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:86056 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-10.2.z] (JIRA:Rocky Linux-282106)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142363 advisory.

    lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:86056 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
      * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)


    Bug Fix(es) and Enhancement(s):

      * lrzsz: segfault with -s [almalinux-10.2.z] (JIRA:AlmaLinux-282106)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:86056 advisory.

    Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the     public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem     solution for Linux systems.

    Security Fix(es):

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-10.2.z] (JIRA:RHEL-282106)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-86056 advisory.

    - Backport tightened path handling from 0.13.1 (CVE-2026-105840)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792503867 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792503867 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_83525 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:83525 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-8.10.z] (JIRA:Rocky Linux-282148)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2077:01 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
      * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-83525 advisory.

    - Backport tightened path handling from 0.13.1 (CVE-2026-105840)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:83525 advisory.

    Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the     public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem     solution for Linux systems.

    Security Fix(es):

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)

    * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)

    Bug Fix(es) and Enhancement(s):

    * lrzsz: segfault with -s [rhel-8.10.z] (JIRA:RHEL-282148)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792053113 advisory.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

  - lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode     that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a     suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to     popen(), so shell metacharacters execute as the receiving user. (CVE-2026-105841)

  - lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in procheader() of the lrz receive     utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply     filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap     memory and crash lrz. (CVE-2026-105842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:83525 advisory.

    * lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840)
      * lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841)


    Bug Fix(es) and Enhancement(s):

      * lrzsz: segfault with -s [almalinux-8.10.z] (JIRA:AlmaLinux-282148)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode     that allows malicious ZMODEM senders to write files outside the current directory using absolute     pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-     pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving     user. (CVE-2026-105840)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
372468	MiracleLinux 9 : lrzsz-0.12.20-58.el9_8 (AXSA:2026-2168:02)	Nessus	Miracle Linux Local Security Checks	Local	high
372434	RockyLinux 9 : lrzsz (RLSA-2026:89755)	Nessus	Rocky Linux Local Security Checks	Local	high
372069	Oracle Linux 9 : lrzsz (ELSA-2026-89755)	Nessus	Oracle Linux Local Security Checks	Local	high
371997	RHEL 9 : lrzsz (RHSA-2026:89755)	Nessus	Red Hat Local Security Checks	Local	high
370343	Rocky Linux 10.2 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_86056)	Nessus	Rocky Linux Local Security Checks	Local	high
370178	RockyLinux 10 : lrzsz (RLSA-2026:86056)	Nessus	Rocky Linux Local Security Checks	Local	high
370009	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: lrzsz (UTSA-2026-142363)	Nessus	Unity Linux Local Security Checks	Local	high
369995	AlmaLinux 10 : lrzsz (ALSA-2026:86056)	Nessus	Alma Linux Local Security Checks	Local	high
369334	RHEL 10 : lrzsz (RHSA-2026:86056)	Nessus	Red Hat Local Security Checks	Local	high
369320	Oracle Linux 10 : lrzsz (ELSA-2026-86056)	Nessus	Oracle Linux Local Security Checks	Local	high
367934	Rocky Linux 9.6 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792503867)	Nessus	Rocky Linux Local Security Checks	Local	high
367916	AlmaLinux 9.6 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792503867)	Nessus	Alma Linux Local Security Checks	Local	high
366763	Rocky Linux 8 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_83525)	Nessus	Rocky Linux Local Security Checks	Local	high
366493	RockyLinux 8 : lrzsz (RLSA-2026:83525)	Nessus	Rocky Linux Local Security Checks	Local	high
366455	MiracleLinux 8 : lrzsz-0.12.20-46.el8_10 (AXSA:2026-2077:01)	Nessus	Miracle Linux Local Security Checks	Local	high
366314	Oracle Linux 8 : lrzsz (ELSA-2026-83525)	Nessus	Oracle Linux Local Security Checks	Local	high
366117	RHEL 8 : lrzsz (RHSA-2026:83525)	Nessus	Red Hat Local Security Checks	Local	high
366112	AlmaLinux 9.2 [TuxCare] Security Update: lrzsz Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792053113)	Nessus	Alma Linux Local Security Checks	Local	high
366106	AlmaLinux 8 : lrzsz (ALSA-2026:83525)	Nessus	Alma Linux Local Security Checks	Local	high
363476	Linux Distros Unpatched Vulnerability : CVE-2026-105840	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-105840

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high