CVE-2026-105841

A flaw was found in lrzsz. When operating in pipe mode, the lrz receive utility does not properly sanitize file names received during file transfers before passing them to the system shell. A remote attacker can exploit this flaw by sending a specially crafted file name, leading to arbitrary command execution with the permissions of the receiving user.

This vulnerability is rated as an Important severity flaw for Red Hat Enterprise Linux because a remote sender can execute arbitrary commands with the privileges of the receiving user during file transfer operations. Although the impact allows full code execution without administrative access, exploitation is limited by the prerequisite of active user interaction to initiate a transfer and specifically requires invocation in pipe mode (such as via lrztar). Standard file transfers that write directly to local disk rather than streaming through external command pipelines remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.