CVE-2026-48962

HighCVSS 7.3

Published: 27/05/2026(UTC)Updated: 05/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Vulnerability in IO::Compress for Perl before version 2.220 allows arbitrary code execution via File::GlobMapper using an attacker-controlled output glob. The _parseOutputGlob() wraps the glob in quotes, and _getFiles() evaluates it via eval STRING, enabling Perl code injection.

Risk Assessment

Risk of remote arbitrary code execution with the calling process's privileges, potentially leading to full system compromise.

Recommendation

Update IO::Compress to version 2.220 or later.

Other vulnerabilities in IO::Compress

CVE-2026-48961High
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. The defect is in the bundled CLI tool, not the library.

Original NVD description (English source)

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.