CVE catalog

CVE-2026-48962

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in d

[CVE catalog]

Severity: Critical · CVSS 9.1
Published: May 27, 2026, 4:16:31 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.50% · Oct 23, 2026

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	perl	sid	`5.42.3-1`	fixed
Debian	perl	forky	`5.42.3-1`	fixed
Debian	perl	trixie	`5.40.1-6+deb13u1`	fixed
Debian	perl	bookworm	`5.36.0-7+deb12u3`	vulnerable
Debian	perl	bookworm-security	`5.36.0-7+deb12u4`	fixed
Debian	libio-compress-perl	sid	`2.225-1`	fixed
Debian	libio-compress-perl	forky	`2.225-1`	fixed
Debian	libio-compress-perl	trixie	`2.213-1+deb13u1`	fixed
Debian	libio-compress-perl	bookworm	`2.204-1`	vulnerable
Debian	libio-compress-perl	bookworm-security	`2.204-1+deb12u1`	fixed
Cpe	libio-compress-perl	Not reported	Not reported	vulnerable
Cpe	perl	Not reported	Not reported	vulnerable
Ubuntu	perl	noble	`5.38.2-3.2ubuntu0.4`	fixed
Ubuntu	libperl-dev	noble	`5.38.2-3.2ubuntu0.4`	fixed
Ubuntu	libperl5.38t64	noble	`5.38.2-3.2ubuntu0.4`	fixed
Ubuntu	perl-base	noble	`5.38.2-3.2ubuntu0.4`	fixed
Ubuntu	perl-debug	noble	`5.38.2-3.2ubuntu0.4`	fixed
Ubuntu	perl-doc	noble	`5.38.2-3.2ubuntu0.4`	fixed
Ubuntu	perl-modules-5.38	noble	`5.38.2-3.2ubuntu0.4`	fixed
Opensuse	perl-IO-Compress	tumbleweed	`2.220.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	perl	source	sid	`5.40.1-8`	not yet assigned	Not reported	[1138854]
Debian	perl	source	forky	`5.40.1-8`	not yet assigned	Not reported	[1138854]
Debian	perl	source	trixie	`5.40.1-6+deb13u1`	not yet assigned	Not reported	[1138854]
Debian	perl	source	bookworm	`5.36.0-7+deb12u4`	not yet assigned	Not reported	[1138854]
Debian	libio-compress-perl	source	sid	`2.220-1`	not yet assigned	Not reported	[1138055]
Debian	libio-compress-perl	source	forky	`2.220-1`	not yet assigned	Not reported	[1138055]
Debian	libio-compress-perl	source	trixie	`2.213-1+deb13u1`	not yet assigned	Not reported	[1138055]
Debian	libio-compress-perl	source	bookworm	`2.204-1+deb12u1`	not yet assigned	Not reported	[1138055]
Ubuntu	perl	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	libperl-dev	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	libperl5.38t64	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	perl-base	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	perl-debug	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	perl-doc	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Ubuntu	perl-modules-5.38	deb	noble	`5.38.2-3.2ubuntu0.4`	Not reported	Not reported	Not reported
Opensuse	perl-IO-Compress	rpm	tumbleweed	`2.220.0-1.1`	Not reported	OPENSUSE-SU-2026:10939-1	Not reported

[Debian bug #1138854][Debian bug #1138055]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libio-compress-perl]Affected
Details (2)
- 2.204-1 · all · bookworm
  Affected · Fixed: 2.204-1+deb12u1
  nvd · libio-compress-perl · debian · bookworm; nvd · libio-compress-perl · debian · 12
- 2.204-1 · all · bookworm
  Affected · Fixed: 2.204-1+deb12u1
  nvd · libio-compress-perl · debian · bookworm; nvd · libio-compress-perl · debian · 12
[libperl5.36]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[libperl-dev]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl]Affected
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-base]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-debug]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-doc]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-modules-5.36]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12

[Debian 13 (Trixie)]

[libio-compress-perl]Affected
Details (2)
- 2.213-1 · all · trixie
  Affected · Fixed: 2.213-1+deb13u1
  nvd · libio-compress-perl · debian · 13
- 2.213-1 · all · trixie
  Affected · Fixed: 2.213-1+deb13u1
  nvd · libio-compress-perl · debian · 13
[libperl5.40]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[libperl-dev]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl]Affected
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-base]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-debug]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-doc]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-modules-5.40]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13

[openSUSE Tumbleweed]

[perl-IO-Compress]Fixed
Source package: [perl-IO-Compress]
Details (1)
- 2.223.0-1.1 · noarch · tumbleweed
  Fixed · Fixed: 2.220.0-1.1
  nvd · perl-IO-Compress · opensuse · tumbleweed

Observed: Oct 23, 2026, 10:01:51 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]