CVE-2026-48962
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
27/05/2026
Última modificación:
27/05/2026
Descripción
*** Pendiente de traducción *** IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.<br />
<br />
_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.<br />
<br />
Arbitrary Perl in the output glob executes at the calling process&#39;s privilege.
Impacto
Puntuación base 3.x
7.30
Gravedad 3.x
ALTA