Path Traversal Vulnerability in C-Kermit by OpenKermit

CVE-2026-129121

What is CVE-2026-129121?

C-Kermit version 8.0.200 prior to 11.1.515 is susceptible to a path traversal vulnerability located in the doftpget() function within the ckcftp.c file. This flaw could allow malicious FTP servers to manipulate file paths, potentially writing files outside of the designated directories. By exploiting this vulnerability during the MGET/RECURSIVE operation, attackers can leverage absolute paths, tilde shorthand, or parent directory references to overwrite critical files such as .bashrc, which can lead to unauthorized code execution and compromise of the system.

References