IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. (CVE-2026-48962)
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
AI Analysis
Technical Summary
The vulnerability in IO::Compress versions prior to 2.220 arises from improper neutralization of directives in dynamically evaluated code (CWE-95). Specifically, the _parseOutputGlob() function wraps a user-supplied output glob string in double quotes and stores it in parser state. Subsequently, _getFiles() evaluates this stored expression using Perl's eval STRING. If the output glob contains a literal double quote, it prematurely closes the wrapper, allowing the following characters to be interpreted and executed as Perl code. This results in arbitrary code execution at the privilege level of the calling process. The flaw affects the File::GlobMapper component and can be exploited remotely by crafting malicious input. Red Hat has published advisories and released updated packages addressing this issue for Red Hat Enterprise Linux 7 Extended Lifecycle Support. However, some mitigation options are limited or do not fully meet Red Hat's criteria for deployment.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary Perl code with the privileges of the affected process, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. It is rated with a CVSS 3.1 base score of 7.3 (high severity) by cve.org, indicating a significant risk. The flaw can be exploited without user interaction and requires no privileges, making it a critical concern for affected environments.
Mitigation Recommendations
Red Hat has released security updates for affected versions of perl-IO-Compress, specifically for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Applying these official patches is the recommended remediation. Currently, no alternative mitigations fully meet Red Hat's criteria for ease of use, applicability, or stability. Users should upgrade to the fixed versions as detailed in Red Hat advisory RHSA-2026:30843. For environments where patching is not immediately possible, consult Red Hat support or Technical Account Managers for guidance. Patch status is confirmed with official fixes available.
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. (CVE-2026-48962)
Description
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
CVSS v3.1
Score 7.3high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in IO::Compress versions prior to 2.220 arises from improper neutralization of directives in dynamically evaluated code (CWE-95). Specifically, the _parseOutputGlob() function wraps a user-supplied output glob string in double quotes and stores it in parser state. Subsequently, _getFiles() evaluates this stored expression using Perl's eval STRING. If the output glob contains a literal double quote, it prematurely closes the wrapper, allowing the following characters to be interpreted and executed as Perl code. This results in arbitrary code execution at the privilege level of the calling process. The flaw affects the File::GlobMapper component and can be exploited remotely by crafting malicious input. Red Hat has published advisories and released updated packages addressing this issue for Red Hat Enterprise Linux 7 Extended Lifecycle Support. However, some mitigation options are limited or do not fully meet Red Hat's criteria for deployment.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary Perl code with the privileges of the affected process, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. It is rated with a CVSS 3.1 base score of 7.3 (high severity) by cve.org, indicating a significant risk. The flaw can be exploited without user interaction and requires no privileges, making it a critical concern for affected environments.
Mitigation Recommendations
Red Hat has released security updates for affected versions of perl-IO-Compress, specifically for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Applying these official patches is the recommended remediation. Currently, no alternative mitigations fully meet Red Hat's criteria for ease of use, applicability, or stability. Users should upgrade to the fixed versions as detailed in Red Hat advisory RHSA-2026:30843. For environments where patching is not immediately possible, consult Red Hat support or Technical Account Managers for guidance. Patch status is confirmed with official fixes available.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:29210
- Cve Count
- 1
- State
- PUBLISHED
Threat ID: 6a3c3b294853345fc1c94005
Added to database: 06/24/2026, 20:16:41 UTC
Last enriched: 08/05/2026, 18:29:58 UTC
Last updated: 09/12/2026, 14:26:38 UTC
Views: 175
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.