Riskcovery

CVE-2026-48962

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

State
Published
Severity
7.3 High
Published
May 27, 2026
Updated
Aug 5, 2026
Reserved
May 26, 2026

Read the record on cve.org

Description

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

Arbitrary Perl in the output glob executes at the calling process's privilege.

Scores

CVSSScoreVectorSource
3.17.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCISA-ADP
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
IO::CompressPMQS
  • before 2.220Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.