Config::IniFiles versions prior to 3.001000 for Perl are vulnerable to OS command injection due to improper neutralization of special elements in the -file argument used by the _make_filehandle function. The vulnerability arises because the function uses Perl's 2-argument open() on the filename, which interprets filenames beginning or ending with pipe characters or redirection operators as commands or redirects rather than file paths. This allows an attacker who can supply untrusted input to the -file argument to execute arbitrary OS commands or overwrite files with the privileges of the running process. The vulnerability does not affect in-memory scalar references passed to -file. No official patch or remediation level is currently documented.

Successful exploitation allows an attacker to execute arbitrary OS commands or overwrite files with the permissions of the process running Config::IniFiles. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The CVSS score of 8.6 (high) reflects the potential for significant damage with low attack complexity but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to the -file argument of Config::IniFiles. Use in-memory scalar references (-file => \$text) instead of file paths when possible to mitigate risk.