{"id":"CVE-2026-129119","kind":"vulnerability","aliases":["CVE-2026-129119"],"related":[],"title":"C-Kermit: file collision check bypass lets senders append to existing files","description":"C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.","summary":"C-Kermit, a file transfer program, can be tricked by a malicious sender marking a transfer as RESEND into appending data to existing files without a confirmation prompt. An attacker can thereby modify files such as shell startup files on the receiving machine.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"C-Kermit","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c-kermit","file-transfer","other","unix"],"not_affected_if":["no-incoming-transfers","not-installed"],"how_to_check":"- Check the installed C-Kermit version with `kermit -v` or the version banner shown on start; versions from `6.0.192` up to but not including `11.1.515` are affected.\n- Check whether the C-Kermit build in use came from a distribution package, which may carry a different version number.","fix":"- C-Kermit: move to `11.1.515` or later.","status":"open","published_at":"2026-11-13T17:17:28+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","triaged_at":"2026-11-13T17:48:55+00:00","updated_at":"2026-11-13T17:48:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-13T17:48:55Z","model":"claude-haiku-5-5","output":{"fix":"- C-Kermit: move to `11.1.515` or later.","reach":"network","title":"C-Kermit: file collision check bypass lets senders append to existing files","impact":"high","summary":"C-Kermit, a file transfer program, can be tricked by a malicious sender marking a transfer as RESEND into appending data to existing files without a confirmation prompt. An attacker can thereby modify files such as shell startup files on the receiving machine.","audience":"businesses","category":"other","nicknames":[],"who_cares":["c-kermit","unix","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker appends code to shell startup files, enabling later code execution","analyst_note":"Confirm whether a receive confirmation or other setting changes exposure, and whether distro packages carry the fix; see the linked vendor advisory and patch.","how_to_check":"- Check the installed C-Kermit version with `kermit -v` or the version banner shown on start; versions from `6.0.192` up to but not including `11.1.515` are affected.\n- Check whether the C-Kermit build in use came from a distribution package, which may carry a different version number.","plain_action":"","product_name":"C-Kermit","needs_analyst":true,"not_affected_if":["no-incoming-transfers","not-installed"],"who_is_affected":"Any system that runs C-Kermit in a version from 6.0.192 up to but not including 11.1.515 and accepts incoming file transfers from other parties is exposed. Systems that do not run C-Kermit or never receive files through it can skip this.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":4652,"output_tokens":603,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-129119':16A,19A '-2026':15A,18A '11.1.515':81C '6.0.192':79C 'allow':89C 'append':10A,51B,93C,116C 'attack':61B,123C 'bypass':7A,87C 'c':2A,21A,24B,32B,76C 'c-kermit':1A,20A,23B,31B,75C 'check':6A 'ckcfn3.c':107C 'clear':108C 'collis':5A,85C 'confirm':58B,120C 'contain':82C 'cve':14A,17A 'data':52B,94C 'discard':111C 'exist':12A,54B,96C 'file':4A,13A,27B,35B,55B,65B,70B,84C,97C,125C,130C 'file-transf':26B 'flag':112C 'function':105C 'gattr':104C 'kermit':3A,22A,25B,33B,77C 'let':8A,122C 'machin':74B 'malici':43B,90C 'mark':45B,99C 'modifi':64B,124C 'program':37B 'prompt':59B,121C 'protect':86C 'receiv':73B,119C 'reject':110C 'resend':49B,102C 'sender':9A,44B,91C 'shell':68B,128C 'startup':69B,129C 'switch':114C 'therebi':63B 'transfer':28B,36B,47B,100C 'trick':40B 'unix':30B 'without':56B,117C","nicknames":[],"mitigations":[],"who_affected":"Any system that runs C-Kermit in a version from 6.0.192 up to but not including 11.1.515 and accepts incoming file transfers from other parties is exposed. Systems that do not run C-Kermit or never receive files through it can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ckermit"],"ptokens":["kermit"],"labels":["ckermit","filetransfer","high","other","unix","vendor"],"campaign_type":null,"search_a":"'-129119':16A,19A '-2026':15A,18A 'append':10A 'bypass':7A 'c':2A,21A 'c-kermit':1A,20A 'check':6A 'collis':5A 'cve':14A,17A 'exist':12A 'file':4A,13A 'kermit':3A,22A 'let':8A 'sender':9A","search_b":"'append':51B 'attack':61B 'c':24B,32B 'c-kermit':23B,31B 'confirm':58B 'data':52B 'exist':54B 'file':27B,35B,55B,65B,70B 'file-transf':26B 'kermit':25B,33B 'machin':74B 'malici':43B 'mark':45B 'modifi':64B 'program':37B 'prompt':59B 'receiv':73B 'resend':49B 'sender':44B 'shell':68B 'startup':69B 'therebi':63B 'transfer':28B,36B,47B 'trick':40B 'unix':30B 'without':56B","search_c":"'11.1.515':81C '6.0.192':79C 'allow':89C 'append':93C,116C 'attack':123C 'bypass':87C 'c':76C 'c-kermit':75C 'ckcfn3.c':107C 'clear':108C 'collis':85C 'confirm':120C 'contain':82C 'data':94C 'discard':111C 'exist':96C 'file':84C,97C,125C,130C 'flag':112C 'function':105C 'gattr':104C 'kermit':77C 'let':122C 'malici':90C 'mark':99C 'modifi':124C 'prompt':121C 'protect':86C 'receiv':119C 'reject':110C 'resend':102C 'sender':91C 'shell':128C 'startup':129C 'switch':114C 'transfer':100C 'without':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-31T01:21:24+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129119","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129119","severity":null,"published_at":"2026-11-13T17:17:28+00:00","modified_at":"2026-11-13T17:17:28+00:00","first_seen_at":"2026-11-13T17:48:00+00:00","fetched_at":"2026-11-13T17:48:00+00:00","note":null}],"documents":[{"id":148087,"url":"https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":148076,"url":"https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":148089,"url":"https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-31T01:21:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":148090,"url":"https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}