CVE-2026-48962
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A vulnerability in the IO::Compress library for Perl before version 2.220 allows arbitrary code execution via an attacker-controlled output glob in File::GlobMapper. The issue stems from improper handling of double quotes in the output argument, leading to Perl code evaluation.
Risk Assessment
An attacker can remotely execute arbitrary Perl code with the privileges of the calling process, potentially leading to full system compromise or data theft.
Recommendation
Immediately update the IO::Compress library to version 2.220 or later. If an update is not possible, avoid using File::GlobMapper with untrusted input.
Original NVD description (English source)
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.