C-KERMIT · CVE-2026-129119 · Other
NO FIX YET · SEE WHAT TO DO
C-Kermit, a file transfer program, can be tricked by a malicious sender marking a transfer as RESEND into appending data to existing files without a confirmation prompt. An attacker can thereby modify files such as shell startup files on the receiving machine.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any system that runs C-Kermit in a version from 6.0.192 up to but not including 11.1.515 and accepts incoming file transfers from other parties is exposed. Systems that do not run C-Kermit or never receive files through it can skip this.
Not affected if no-incoming-transfers, not-installed
Who cares c-kermit, file-transfer, unix
kermit -v or the version banner shown on start; versions from 6.0.192 up to but not including 11.1.515 are affected.11.1.515 or later.C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.