CVE-2026-129121 in C-Kermit
Summary
by MITRE • 11/13/2026
C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/13/2026
The vulnerability identified in C-Kermit versions prior to 11.1.515 represents a critical path traversal flaw located within the doftpget function of the ckcftp.c source file. This security defect arises from insufficient validation and sanitization of directory paths returned by remote FTP servers during recursive download operations, specifically when utilizing MGET or RECURSIVE commands. The core technical issue lies in the application's failure to properly canonicalize or restrict file system access based on the current working directory context before writing downloaded files. When a malicious FTP server responds with NLST or MLSD listings containing absolute paths, tilde expansions representing user home directories, or dot-dot components intended for parent directory navigation, C-Kermit processes these directives without adequate boundary checks. This allows an attacker to manipulate the file system structure by directing the client to write files outside of the designated target directory, effectively bypassing standard sandboxing mechanisms inherent in local download operations.
From a technical perspective, this flaw enables arbitrary file writes across the victim's operating system with the privileges of the user executing C-Kermit. By leveraging absolute paths or relative path traversal sequences such as ../, an attacker can overwrite critical configuration files located outside the intended scope. Common targets for exploitation include shell initialization scripts like .bashrc, profile configurations, or other executable binaries residing in sensitive directories. The ability to write arbitrary content into these locations is particularly dangerous because many of these files are automatically sourced or executed during user login sessions or application startup processes. Consequently, injecting malicious code snippets such as reverse shells, credential harvesters, or persistent backdoors into .bashrc ensures that the payload executes every time a new shell session is initiated by the victim, thereby achieving remote code execution without requiring direct interactive access to the target system.
The operational impact of this vulnerability extends beyond simple data exfiltration or local privilege escalation through file overwrites; it fundamentally compromises the integrity and availability of the host environment. An attacker who successfully exploits this path traversal can establish a persistent foothold within the organization's network by compromising user accounts via modified shell configurations. This leads to unauthorized access, potential lateral movement if credentials are harvested from memory or configuration files, and significant disruption to system operations if critical binaries or scripts are corrupted. The risk is exacerbated in environments where C-Kermit is used for automated data transfer workflows, as these processes often run with elevated privileges or against trusted internal servers that might be compromised by an external threat actor aiming to pivot into the network.
This vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Code Injection via file write operations. In terms of adversary behavior, it maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing injected payloads and potentially T1037 Boot or Logon Initialization Scripts if the targeted files are shell profiles. To mitigate this risk, organizations should immediately upgrade C-Kermit to version 11.1.515 or later where these path validation checks have been implemented. In scenarios where upgrading is not immediately feasible, administrators can implement network-level controls such as firewall rules to restrict FTP traffic from untrusted sources and enforce strict allow-listing of known good FTP servers. Additionally, applying principle of least privilege by running C-Kermit under restricted user accounts with limited write permissions to system directories can reduce the blast radius should an exploitation attempt occur. Regular auditing of shell configuration files for unauthorized modifications is also recommended as a defensive monitoring measure.