The DBD::File Perl module versions prior to 1.651 do not ensure that the table file path is not a symbolic link to an untrusted location. Specifically, the complete_table_name method constructs an absolute path to the table file without checking for symbolic links. This flaw allows an attacker who can place or manipulate symlinks inside the data directory to cause the driver to read or write files outside the intended f_dir and f_dir_search directories, resulting in a path traversal vulnerability (CWE-22) and potential unauthorized file access or modification.

Exploitation of this vulnerability allows an attacker to read or write arbitrary files outside the designated data directories by leveraging symbolic links. This can lead to unauthorized disclosure or modification of sensitive files on the system where the vulnerable DBD::File module is used. The impact depends on the privileges of the process using the module and the files accessible via symlinks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted symbolic links within the data directories or restrict access to these directories to trusted users only. Monitor vendor communications for updates regarding an official fix.