C-KERMIT · CVE-2026-129120 · Other
NO FIX YET · SEE WHAT TO DO
C-Kermit 11.0.506 before 11.1.515 lets a malicious Kermit server write files to the client without asking the user, bypassing the RECEIVE CONFIRM check. An attacker can drop files such as .ssh/authorized_keys or shell startup files, which gives persistent access or code execution.
first public Oct 31, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run C-Kermit 11.0.506 through versions before 11.1.515 and use it to receive files from remote Kermit servers are exposed. The sources do not say whether a non-default configuration is needed, so systems that never connect to untrusted Kermit servers are likely lower risk.
Not affected if no-untrusted-kermit-servers
Who cares c-kermit, kermit, linux, unix
kermit -v or the version banner shown on start-up11.1.515 as affected11.1.515C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.