The vulnerability in DBD::File versions prior to 1.651 arises because the complete_table_name method constructs absolute file paths without verifying whether the target file is a symbolic link. This flaw permits an attacker to create a symlink inside the data directory that points to arbitrary files outside the configured f_dir and f_dir_search directories. Consequently, file-based drivers can be tricked into accessing or modifying files beyond their intended scope, leading to unauthorized read or write operations. The CVSS 3.1 base score is 7.7, reflecting local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity.

Successful exploitation allows an attacker to read or write files outside the designated data directories, compromising the confidentiality and integrity of the system. This could lead to unauthorized data disclosure or modification. The vulnerability does not affect availability and does not require privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using vulnerable versions of DBD::File and restrict file system permissions to limit potential impact. Monitoring for suspicious symbolic links in data directories may help detect exploitation attempts.