CVE-2026-15392CWE-22CWE-59

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

High · published July 14, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
5.2
In the wild
Unconfirmed
What it is

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00163 · 5.2th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-07-14T15:34Z
EPSS history
Timeline
  • 14 JUL 15:34Z
    DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
    cvelistv5