new file mode 100644
@@ -0,0 +1,106 @@
+From b1fc8a01e3a074f8462a29dca45ed7c8fd2ef665 Mon Sep 17 00:00:00 2001
+From: Uwe Ohse at akiar <uwe@ohse.de>
+Date: Mon, 10 Aug 2026 18:09:20 +0200
+Subject: [PATCH] remove PUBDIR, fix the 2nd security hole found by
+ tristaninsec
+
+CVE: CVE-2026-105840
+Upstream-Status: Backport [https://github.com/UweOhse/lrzsz/commit/b1fc8a01e3a074f8462a29dca45ed7c8fd2ef665]
+
+Backport Changes:
+- Applied the configure.ac change to configure.in, which is the build
+ configuration filename used by lrzsz 0.12.20.
+- Omitted NEWS because its 0.13.0 release-note hunk conflicts with the
+ 0.12.20 release history and is not needed for the security fix.
+
+(cherry picked from commit b1fc8a01e3a074f8462a29dca45ed7c8fd2ef665)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ configure.in | 7 -------
+ src/lrz.c | 16 +++++-----------
+ src/lsz.c | 9 ++-------
+ 3 files changed, 7 insertions(+), 25 deletions(-)
+
+diff --git a/configure.in b/configure.in
+index b7c3c31..504bd32 100644
+--- a/configure.in
++++ b/configure.in
+@@ -37,13 +37,6 @@ AC_ARG_ENABLE(timesync,
+ fi],
+ [AC_DEFINE(ENABLE_TIMESYNC)])
+ AC_SUBST(ENABLE_TIMESYNC)
+-AC_ARG_ENABLE(pubdir,
+- [--enable-pubdir=/path include support for a public writeable directory],
+- [if test "$enableval" = "no" ; then
+- :
+- else
+- AC_DEFINE_UNQUOTED(PUBDIR,"$enableval")
+- fi])
+ AC_ARG_ENABLE(mkdir,
+ [--disable-mkdir disable support for creating directories (lrz)],
+ [if test "$enableval" = "no" ; then
+diff --git a/src/lrz.c b/src/lrz.c
+index 9c08a3d..168636e 100644
+--- a/src/lrz.c
++++ b/src/lrz.c
+@@ -1553,12 +1553,10 @@ chkinvok(const char *s)
+ }
+
+-/*
+- * Totalitarian Communist pathname processing
+- */
+ static void
+ checkpath(const char *name)
+ {
+ if (Restricted) {
++ FILE *noleak = NULL;
+ const char *p;
+ p=strrchr(name,'/');
+ if (p)
+@@ -1595,20 +1593,16 @@ checkpath(const char *name)
+ p=name;
+ /* don't overwrite any file in very restricted mode.
+ * don't overwrite hidden files in restricted mode */
+- if ((Restricted==2 || *name=='.') && fopen(name, "r") != NULL) {
++ if ((Restricted==2 || *name=='.') && (noleak = fopen(name, "r")) != NULL) {
++ fclose(noleak);
+ canit(STDOUT_FILENO);
+ vstring("\r\n");
+ vstringf(_("%s: %s exists\n"),
+ program_name, name);
+ bibi(-1);
+ }
+- /* restrict pathnames to current tree or uucppublic */
+- if ( strstr(name, "../")
+-#ifdef PUBDIR
+- || (name[0]== '/' && strncmp(name, PUBDIR,
+- strlen(PUBDIR)))
+-#endif
+- ) {
++ /* restrict pathnames to the current tree */
++ if ( strstr(name, "../") || name[0] == '/') {
+ canit(STDOUT_FILENO);
+ vstring("\r\n");
+ vstringf(_("%s:\tSecurity Violation"),program_name);
+diff --git a/src/lsz.c b/src/lsz.c
+index 69f4fb8..3dd91b1 100644
+--- a/src/lsz.c
++++ b/src/lsz.c
+@@ -1009,13 +1009,8 @@ wcs(const char *oname, const char *remotename)
+
+
+ if (Restricted) {
+- /* restrict pathnames to current tree or uucppublic */
+- if ( strstr(oname, "../")
+-#ifdef PUBDIR
+- || (oname[0]== '/' && strncmp(oname, MK_STRING(PUBDIR),
+- strlen(MK_STRING(PUBDIR))))
+-#endif
+- ) {
++ /* restrict pathnames to current tree */
++ if ( strstr(oname, "../") || oname[0] == '/') {
+ canit(STDOUT_FILENO);
+ vchar('\r');
+ error(1,0,
+--
+2.35.6
@@ -22,6 +22,7 @@ SRC_URI = "https://www.ohse.de/uwe/releases/lrzsz-${PV}.tar.gz \
file://0001-Fix-build-with-GCC-15.patch \
file://0001-lrzsz-convert-K-R-function-definitions-to-ANSI-C-pro.patch \
file://CVE-2026-105841.patch \
+ file://CVE-2026-105840.patch \
"
SRC_URI[sha256sum] = "c28b36b14bddb014d9e9c97c52459852f97bd405f89113f30bee45ed92728ff1"