CVE-2026-15392
Published: July 17, 2026Last modified: July 20, 2026
Description
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.7 |
| Attack Vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity impact | HIGH |
| Availability impact | NONE |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | perl-dbi | Unknown (1.643-r4) |
| 25 LTS | perl-dbi | Unknown (1.647-r0) | |
| Stream | perl-dbi | Unknown (1.643-r3) |