The IO::Compress Perl module versions prior to 2.220 contain a vulnerability (CWE-95) where the _parseOutputGlob() function wraps a user-supplied output glob string in double quotes and stores it in parser state. The _getFiles() function subsequently evaluates this stored expression using Perl's eval function. If the output glob includes a literal double quote, it breaks out of the quoted context, allowing the following characters to be interpreted and executed as Perl code. This results in arbitrary code execution at the privilege level of the calling process. The vulnerability affects the File::GlobMapper component of IO::Compress. Red Hat has issued security advisories and released patched versions (perl-IO-Compress 2.061-2.el7_9.1) for Red Hat Enterprise Linux 7 Extended Lifecycle Support to address this issue.

Successful exploitation allows an unauthenticated attacker to execute arbitrary Perl code on the affected system with the privileges of the calling process. This can lead to confidentiality, integrity, and availability impacts, including potential system compromise. The CVSS v3.1 base score is 7.3 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

A security update fixing this vulnerability is available from Red Hat for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Users should apply the updated perl-IO-Compress package (version 2.061-2.el7_9.1 or later) as provided in Red Hat advisory RHSA-2026:30843. This official fix addresses the arbitrary code execution issue. No additional mitigation steps are required beyond applying the vendor-provided patch.