The IO::Compress Perl module versions prior to 2.220 contain a code injection vulnerability (CWE-95) in the File::GlobMapper functionality. Specifically, the _parseOutputGlob() function wraps a user-supplied output glob string in double quotes and stores it in parser state. Subsequently, _getFiles() evaluates this stored string using Perl's eval. If the output glob contains a literal double quote, it prematurely closes the quoted string, allowing the remainder to be interpreted and executed as Perl code. This leads to arbitrary code execution with the privileges of the calling process.

An attacker able to supply a crafted output glob string can execute arbitrary Perl code on the affected system with the privileges of the process running IO::Compress. This can lead to confidentiality, integrity, and availability impacts including unauthorized code execution, data manipulation, or denial of service.

Red Hat has released security updates addressing this vulnerability for affected Red Hat Enterprise Linux 7 Extended Lifecycle Support packages. Users should apply the official perl-IO-Compress updates provided by Red Hat as detailed in the advisory (RHSA-2026:30843). Patch status is confirmed by Red Hat advisories. Applying these updates mitigates the vulnerability. No alternative mitigations or workarounds are specified by the vendor.