HTTP::Daemon versions prior to 6.17 for Perl contain an OS command injection vulnerability in the send_file() method. This method uses Perl's 2-argument open() function, which interprets special prefixes such as '| cmd' or 'cmd |' to open pipes to subprocesses, and '> path' or '>> path' to open files for writing or appending. If untrusted input is passed to send_file(), an attacker can execute arbitrary OS commands with the daemon process's user ID. Additionally, the read-pipe form can leak subprocess stdout into HTTP responses, and the write-mode forms can create or truncate files at attacker-controlled paths. This vulnerability is tracked as CVE-2026-8450 with a CVSS score of 9.1 (critical). Red Hat has released security updates for affected packages in Red Hat Enterprise Linux 10 and related products.

Successful exploitation allows unauthenticated attackers to execute arbitrary OS commands with the privileges of the HTTP::Daemon process user. This can lead to full compromise of the affected system, including unauthorized disclosure of subprocess output via HTTP responses and unauthorized file creation or modification. The vulnerability has a CVSS v3.1 base score of 9.1, indicating high confidentiality and integrity impact with no required privileges or user interaction.

Red Hat has released security updates addressing this vulnerability in perl-HTTP-Daemon packages for Red Hat Enterprise Linux 10 and related distributions. Users should apply these official patches promptly. Refer to Red Hat advisory RHSA-2026:36189 and https://access.redhat.com/articles/11258 for update instructions. No alternative mitigations are specified; applying the vendor-provided update is required to remediate the issue.