PUBLISHED
2026-07-08 15:16
MODIFIED
2026-07-08 15:56
EPSS (Prob. Exploit)
0.49%
Top 58.0%
> DESCRIPTION
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.
ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.
A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-73: External Control of File Name or Path - The product allows user input to control or influence paths or file names that are used in filesystem operations. | CWE-426: Untrusted Search Path - The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc
AFFECTED PACKAGES:
Unknown / Unknown
25 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
08/07/2026 15:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-73: External Control of File Name or Path - The product allows user input to control or influence paths or file names that are used in filesystem operations. | CWE-426: Untrusted Search Path - The...
Total des modifications: 1
Dernière mise à jour: 3 months ago