CVE-2026-129119

Name	CVE-2026-129119
Description	C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ckermit (PTS)	bookworm	402~beta08-1	vulnerable
	trixie	416~beta12-1+deb13u1	vulnerable
	forky	1:11.1.515-2	fixed
	sid	1:11.1.517-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ckermit	source	(unstable)	1:11.1.515-1

Notes

[trixie] - ckermit <no-dsa> (Minor issue)
https://github.com/OpenKermit/ckermit/security/advisories/GHSA-vhrv-7jrq-95qj
Fixed by: https://github.com/OpenKermit/ckermit/commit/bbf9923e3e2e04ac3da713998cb15e786e26fdf1 (v11.1.515)