CVE-2026-105841 in lrzsz
Summary
by MITRE • 10/06/2026
lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in versions of lrzsz prior to 0.13.0 represents a critical OS command injection flaw within the receive utility, specifically affecting its pipe mode operation. This security defect allows remote attackers to achieve arbitrary code execution on the target system by exploiting how filenames are processed during file transfer operations. The root cause lies in the improper neutralization of special elements used in commands, commonly categorized under CWE-78 as Improper Neutralization of Special Elements used in an OS Command. When a user initiates a receive operation using specific suffixed names such as lrztar, the application invokes the procheader function located within src/lrz.c to handle incoming file metadata from ZMODEM or YMODEM protocols.
During this process, the filename provided by the remote sender is passed directly to the popen() system call without adequate sanitization or escaping of shell metacharacters. The popen() function typically invokes a command interpreter, such as /bin/sh, to execute the string argument. Because the application fails to validate or escape characters like semicolons, pipes, ampersands, and backticks within the filename field, these special elements are interpreted by the shell rather than treated as literal data. Consequently, an attacker can craft a malicious filename that contains embedded command sequences. When lrz processes this crafted input, it inadvertently executes the injected commands with the privileges of the user running the lrz process.
The operational impact of this vulnerability is severe, particularly in environments where file transfers are initiated by privileged users or automated scripts. An attacker who can interact with the lrz receive utility over a network connection can execute arbitrary system commands, potentially leading to full system compromise. This includes the ability to read sensitive files, modify system configurations, install backdoors, or pivot further into the internal network depending on the context in which lrz is deployed. The vulnerability aligns with ATT&CK technique T1059, Command and Scripting Interpreter, as it involves the execution of commands through a shell environment via an application-level input vector. It also reflects CWE-20 Improper Input Validation, as the software does not sufficiently verify that user-supplied data conforms to expected formats before processing.
Mitigation strategies primarily involve upgrading to lrzsz version 0.13.0 or later, where this issue has been resolved through improved handling of filenames passed to shell-invoking functions. In scenarios where an immediate upgrade is not feasible, administrators should restrict the use of suffixed names like lrztar that trigger the vulnerable code path in procheader(). Additionally, deploying network-level controls such as firewalls to limit access to file transfer services can reduce the attack surface. It is also advisable to run file transfer utilities under restricted user accounts with minimal privileges to limit the potential impact if exploitation occurs. Regular auditing of input validation practices within legacy software components remains essential for maintaining a robust security posture against command injection threats.