---
id: "CVE-2026-129119"
page: "https://infrastack.ai/live/CVE-2026-129119"
kind: "vulnerability"
aliases: ["CVE-2026-129119"]
title: "C-Kermit: file collision check bypass lets senders append to existing files"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "C-Kermit", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["c-kermit", "file-transfer", "other", "unix"]
not_affected_if: ["no-incoming-transfers", "not-installed"]
published_at: "2026-11-13T17:17:28+00:00"
first_seen_at: "2026-11-13T17:48:00+00:00"
updated_at: "2026-11-13T17:48:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129119", "first_seen_at": "2026-11-13T17:48:00+00:00"}]
exploit_sources: []
---

# C-Kermit: file collision check bypass lets senders append to existing files

Link for people: https://infrastack.ai/live/CVE-2026-129119 (this .md is for agents)

C-Kermit, a file transfer program, can be tricked by a malicious sender marking a transfer as RESEND into appending data to existing files without a confirmation prompt. An attacker can thereby modify files such as shell startup files on the receiving machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:C-Kermit affected range not listed fixed no fixed version listed

## How to check

- Check the installed C-Kermit version with `kermit -v` or the version banner shown on start; versions from `6.0.192` up to but not including `11.1.515` are affected.
- Check whether the C-Kermit build in use came from a distribution package, which may carry a different version number.

## Fix

- C-Kermit: move to `11.1.515` or later.

## Timeline

- 2026-11-13T17:48:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129119

## Documents

- [advisory] Vendor advisory: github.com https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/c-kermit-6.0.192-before-11.1.515-file-collision-protection-bypass-via-resend
- [fix] Patch: github.com https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1
- [fix] Release notes: github.com https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515

## From the sources

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_