File Collision Protection Bypass in C-Kermit by OpenKermit

CVE-2026-129119

What is CVE-2026-129119?

C-Kermit versions prior to 11.1.515 are susceptible to a file collision protection bypass that can be exploited by malicious users. This vulnerability allows an attacker to append data to existing files by falsely indicating a transfer as RESEND. Within the code, the gattr() function effectively disables the REJECT discard flag and allows file modifications without a proper RECEIVE CONFIRM prompt, paving the way for unauthorized alterations to critical files, such as shell startup scripts. This vulnerability necessitates immediate action to safeguard file integrity and security.

References