CVE-2026-129119

high

Description

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.

References

https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend

https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj

https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515

https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1

https://github.com/OpenKermit/ckermit/blob/v11.0.514/ckcfn3.c#L1798-L1800

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125560

Details

Source: Mitre, NVD

Published: 2026-11-13

Updated: 2026-11-13

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N

Severity: High

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Severity: Medium

CVSS v4

Base Score: 7.1

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00478