The vulnerability allows a malicious ZMODEM sender to transmit files whose names include absolute paths. When lrz operates in restricted mode, its checkpath() function fails to reject '../' sequences unless built with a specific flag, enabling the sender to target any file that the receiving user can write. This results in arbitrary write privileges, compromising the integrity of the system.

The flaw affects the Uwe Ohse lrzsz package in versions before 0.13.0. Any installation that uses the lrz receive utility, particularly when it is executed under a user with write permissions, is at risk.

With a CVSS score of 7.7 the vulnerability is considered medium to high severity. The EPSS score is not available, indicating that current exploitation data is uncertain. The vulnerability is not listed in CISA’s KEV catalog, but it can be exploited by an attacker who can send ZMODEM files to the vulnerable system. Inference suggests that the attack is remote and requires network access to the lrz service or local exploitation if the utility is run by a privileged user.