The vulnerability in HTTP::Daemon's send_file() function stems from its use of Perl's 2-argument open() call, which interprets strings with special prefixes such as '| cmd' or 'cmd |' to open pipes to subprocesses, and '> path' or '>> path' to write or append to files. If untrusted input is passed to send_file(), an attacker can execute arbitrary OS commands with the daemon's UID. The read-pipe form leaks subprocess stdout into HTTP responses, and the write-mode forms allow file creation or truncation at attacker-specified locations. This constitutes an OS command injection vulnerability (CWE-78) with additional risks related to improper file handling (CWE-73).

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the HTTP::Daemon process. This can lead to unauthorized command execution, data leakage via subprocess output in HTTP responses, and unauthorized file creation or modification on the host system. The vulnerability can compromise the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to the send_file() function. Consider implementing input validation or sanitization to prevent injection of special prefixes. Monitor vendor channels for updates regarding patches or official mitigations.