App::Ack versions up to 3.10.0 for Perl have a vulnerability where the --files-from option can be set in a project .ackrc file, which ack loads by searching up the directory hierarchy. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a malicious .ackrc can specify a path to a file listing arbitrary files. Ack then reads and searches these files, potentially exposing sensitive data outside the intended project scope. Although version 3.10.0 added --follow to the blocklist, --files-from remains accepted, maintaining the risk. This vulnerability affects multiple Ubuntu LTS and other versions where ack is included.

An attacker who can commit a malicious project .ackrc file to an untrusted repository can cause ack to read and output contents of arbitrary files outside the project directory when run by a user. This can lead to unauthorized disclosure of sensitive information. The CVSS vector indicates no confidentiality or integrity impact but a high impact on availability, though the description suggests the primary risk is information exposure via file reads.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid running ack in directories containing untrusted .ackrc files or review and sanitize .ackrc files before use. Upgrading to versions beyond 3.10.0 may help if the vendor blocks --files-from in future releases. Until an official fix is available, manual mitigation by controlling .ackrc files is recommended.