PUBLISHED
2026-07-14 16:16
MODIFIED
2026-07-14 16:44
EPSS (Prob. Exploit)
0.20%
Top 90.6%
> DESCRIPTION
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.
The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.
Callers of file-based drivers can read or write files outside of the data directory.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. | CWE-59: Improper Link Resolution Before File Access - The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
> RED HAT SEVERITY ASSESSMENT
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
AFFECTED PACKAGES:
Unknown / Unknown
54 versions affected
ALIASES:
GHSA-mh3j-xwf4-jrqw
> HISTORIQUE DES MODIFICATIONS
Première apparition
14/07/2026 16:16
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneat...
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - The product uses external input to construct a pathname that is intended to identify a file or directory that i...
📊
ENRICHISSEMENT
19/07/2026 05:01
REDHAT
Champ modifié: Sévérité Red Hat
Nouvelle valeur:
{
"threat_severity": "Moderate",
"severity_scale": null
}
📊
ENRICHISSEMENT
19/07/2026 05:01
REDHAT
Total des modifications: 4
Dernière mise à jour: 5 days ago