CVE-Katalog
CVE-2026-48962
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in d
- Schweregrad
- Critical · CVSS 9.1
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.50% · Oct 23, 2026
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | perl | sid | 5.42.3-1 | fixed |
| Debian | perl | forky | 5.42.3-1 | fixed |
| Debian | perl | trixie | 5.40.1-6+deb13u1 | fixed |
| Debian | perl | bookworm | 5.36.0-7+deb12u3 | vulnerable |
| Debian | perl | bookworm-security | 5.36.0-7+deb12u4 | fixed |
| Debian | libio-compress-perl | sid | 2.225-1 | fixed |
| Debian | libio-compress-perl | forky | 2.225-1 | fixed |
| Debian | libio-compress-perl | trixie | 2.213-1+deb13u1 | fixed |
| Debian | libio-compress-perl | bookworm | 2.204-1 | vulnerable |
| Debian | libio-compress-perl | bookworm-security | 2.204-1+deb12u1 | fixed |
| Cpe | libio-compress-perl | Not reported | Not reported | vulnerable |
| Cpe | perl | Not reported | Not reported | vulnerable |
| Ubuntu | perl | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Ubuntu | libperl-dev | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Ubuntu | libperl5.38t64 | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Ubuntu | perl-base | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Ubuntu | perl-debug | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Ubuntu | perl-doc | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Ubuntu | perl-modules-5.38 | noble | 5.38.2-3.2ubuntu0.4 | fixed |
| Opensuse | perl-IO-Compress | tumbleweed | 2.220.0-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | perl | source | sid | 5.40.1-8 | not yet assigned | Not reported | [1138854] |
| Debian | perl | source | forky | 5.40.1-8 | not yet assigned | Not reported | [1138854] |
| Debian | perl | source | trixie | 5.40.1-6+deb13u1 | not yet assigned | Not reported | [1138854] |
| Debian | perl | source | bookworm | 5.36.0-7+deb12u4 | not yet assigned | Not reported | [1138854] |
| Debian | libio-compress-perl | source | sid | 2.220-1 | not yet assigned | Not reported | [1138055] |
| Debian | libio-compress-perl | source | forky | 2.220-1 | not yet assigned | Not reported | [1138055] |
| Debian | libio-compress-perl | source | trixie | 2.213-1+deb13u1 | not yet assigned | Not reported | [1138055] |
| Debian | libio-compress-perl | source | bookworm | 2.204-1+deb12u1 | not yet assigned | Not reported | [1138055] |
| Ubuntu | perl | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libperl-dev | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | libperl5.38t64 | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | perl-base | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | perl-debug | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | perl-doc | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Ubuntu | perl-modules-5.38 | deb | noble | 5.38.2-3.2ubuntu0.4 | Not reported | Not reported | Not reported |
| Opensuse | perl-IO-Compress | rpm | tumbleweed | 2.220.0-1.1 | Not reported | OPENSUSE-SU-2026:10939-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libio-compress-perl]Betroffen
Details (2)
2.204-1· all · bookwormBetroffen · Behoben:
2.204-1+deb12u1nvd · libio-compress-perl · debian · bookworm; nvd · libio-compress-perl · debian · 12
2.204-1· all · bookwormBetroffen · Behoben:
2.204-1+deb12u1nvd · libio-compress-perl · debian · bookworm; nvd · libio-compress-perl · debian · 12
- [libperl5.36]Betroffen
Quellpaket: [perl]
Details (4)
5.36.0-7+deb12u3· amd64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· arm64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· amd64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· arm64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
- [libperl-dev]Betroffen
Quellpaket: [perl]
Details (4)
5.36.0-7+deb12u3· amd64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· arm64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· amd64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· arm64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
- [perl]Betroffen
Details (4)
5.36.0-7+deb12u3· amd64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· arm64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· amd64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· arm64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
- [perl-base]Betroffen
Quellpaket: [perl]
Details (4)
5.36.0-7+deb12u3· amd64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· arm64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· amd64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· arm64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
- [perl-debug]Betroffen
Quellpaket: [perl]
Details (4)
5.36.0-7+deb12u3· amd64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· arm64 · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· amd64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· arm64 · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
- [perl-doc]Betroffen
Quellpaket: [perl]
Details (4)
5.36.0-7+deb12u3· all · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· all · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· all · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· all · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
- [perl-modules-5.36]Betroffen
Quellpaket: [perl]
Details (4)
5.36.0-7+deb12u3· all · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u3· all · bookwormBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· all · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
5.36.0-7+deb12u2· all · bookworm-securityBetroffen · Behoben:
5.36.0-7+deb12u4nvd · perl · debian · bookworm; nvd · perl · debian · 12
[Debian 13 (Trixie)]
- [libio-compress-perl]Betroffen
Details (2)
2.213-1· all · trixieBetroffen · Behoben:
2.213-1+deb13u1nvd · libio-compress-perl · debian · 13
2.213-1· all · trixieBetroffen · Behoben:
2.213-1+deb13u1nvd · libio-compress-perl · debian · 13
- [libperl5.40]Betroffen
Quellpaket: [perl]
Details (2)
5.40.1-6· amd64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· arm64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
- [libperl-dev]Betroffen
Quellpaket: [perl]
Details (2)
5.40.1-6· amd64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· arm64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
- [perl]Betroffen
Details (2)
5.40.1-6· amd64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· arm64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
- [perl-base]Betroffen
Quellpaket: [perl]
Details (2)
5.40.1-6· amd64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· arm64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
- [perl-debug]Betroffen
Quellpaket: [perl]
Details (2)
5.40.1-6· amd64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· arm64 · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
- [perl-doc]Betroffen
Quellpaket: [perl]
Details (2)
5.40.1-6· all · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· all · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
- [perl-modules-5.40]Betroffen
Quellpaket: [perl]
Details (2)
5.40.1-6· all · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
5.40.1-6· all · trixieBetroffen · Behoben:
5.40.1-6+deb13u1nvd · perl · debian · 13
[openSUSE Tumbleweed]
- [perl-IO-Compress]Behoben
Quellpaket: [perl-IO-Compress]
Details (1)
2.223.0-1.1· noarch · tumbleweedBehoben · Behoben:
2.220.0-1.1nvd · perl-IO-Compress · opensuse · tumbleweed
Beobachtet:
Referenzen
- [https://access.redhat.com/errata/RHSA-2026:29182]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10939-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-48962]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-48962]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10939-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-48962]
- [https://ubuntu.com/security/notices/USN-8684-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2063.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]