Skip to content

GHSA-mh3j-xwf4-jrqw on CTRL-OS 26.05

Aliases: GHSA-mh3j-xwf4-jrqw, CVE-2026-15392

Packages: perlPackages.DBI

Status: Plausible

Advisory Information

DBD::File's f_dir containment — previously assigned CVE-2014-10401 and then CVE-2014-10402 (which NVD records as an incomplete fix of the former) — is still bypassable. After the path-normalisation fix shipped in DBI 1.648, complete_table_name validates the table directory but then builds the table path as File::Spec->catfile($searchdir, $file) (File.pm:674) and open_data opens it with a plain IO::File->new (File.pm:703), which follows symlinks. A symlink planted as the final table file (or a DBM side-file) inside f_dir is therefore followed out of the configured directory (CWE-59 link following; residual CWE-22 containment gap). Same shape at File.pm:688-718 on current master (1.649).

Trigger: an attacker who can create a symlink inside the configured f_dir — a shared, upload-, or sync-writable table directory. With f_dir pointing at that directory, SELECT * FROM victim follows victim.pag/victim.dir symlinks to an outside target.

Impact is read and write outside f_dir with the DBI process's privileges: the PoC reads an outside SECRET and mutates the outside DBM through the planted side-file links (INSERT/UPDATE/DELETE/CREATE TABLE all follow). Narrower than the old ../ traversal (a symlink-create primitive is required), hence low severity.

Fix direction: extend the containment the 1.648 fix started — resolve the real path of the final table file and DBM side-files and reject any that escape f_dir, and/or open final files with O_NOFOLLOW (or refuse symlinked table files). This spans DBD::File and the DBM tie and needs the maintainer's judgement on TOCTOU.

Updates

2026-07-14 17:14 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “Plausible”

(Amended on: 2026-07-14 17:15 CEST)

2026-07-14 16:16 CEST

Metadata changes:

  • Status for package perlPackages.DBI: “New”