Red Hat Product Security issued an advisory (RHSA-2026:30851) for Perl 5.32 on Red Hat Enterprise Linux 8, addressing two vulnerabilities: CVE-2026-42496, a path traversal vulnerability in perl-archive-tar allowing arbitrary file access via crafted symbolic links, and CVE-2026-48962, an arbitrary code execution vulnerability in perl-IO-Compress triggered by attacker-controlled output glob patterns. These vulnerabilities are rated with an important security impact by Red Hat. The advisory provides updated packages to remediate these issues. No CVSS scores are provided in the advisory, but the severity is assessed as important (high).

The path traversal vulnerability (CVE-2026-42496) could allow an attacker to access arbitrary files on the system by exploiting crafted symbolic links in perl-archive-tar. The arbitrary code execution vulnerability (CVE-2026-48962) in perl-IO-Compress could enable an attacker to execute code under the privileges of the Perl process by controlling output glob patterns. Both vulnerabilities pose significant risks to system confidentiality and integrity if exploited.

Red Hat has released updated Perl 5.32 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:30851 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigations are specified or required beyond applying the official update.