CVE-2026-103508: CWE-23 Relative path traversal in Perforce P4 (Helix core)

This vulnerability (CVE-2026-103508) in Perforce P4 Search allows an authenticated administrator to exploit a relative path traversal flaw by providing a malicious logging configuration. This causes the system to write or delete files outside the designated logging directory, potentially enabling code execution under the P4 Search service account. The flaw affects P4 Search versions up to and including 2026.4.2 and was fixed in version 2026.4.3.

Successful exploitation allows an authenticated user with administrative privileges on the P4 Server to execute arbitrary code as the P4 Search service account by manipulating logging configurations to write or delete files outside the intended directory. This elevates the risk of unauthorized system control or compromise.

Upgrade P4 Search to version 2026.4.3 or later, where this vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.