> CVE-2026-8450

« BACK_TO_HOME
PUBLISHED
2026-05-27 05:16
MODIFIED
2026-05-27 05:16
EPSS (Prob. Exploit)
2.61%
Top 14.7%
DATA SOURCES:
NVD 🔗 2026-05-27 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-10-29 MSRC 🔗 2026-11-02

> DESCRIPTION

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-73 CWE-78

> CWE DETAILED DESCRIPTIONS

CWE-73: External Control of File Name or Path - The product allows user input to control or influence paths or file names that are used in filesystem operations. | CWE-78: Improper Neutralization of Special Elements used in an OS Command - The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: perl-HTTP-Daemon security update
An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: perl-HTTP-Daemon security update
An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...
Red Hat Security Advisory: perl-HTTP-Daemon security update
An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...
Red Hat Security Advisory: perl-HTTP-Daemon security update
An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Co...
Red Hat Security Advisory: perl-HTTP-Daemon security update
An update for perl-HTTP-Daemon is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A C...

> GITHUB SECURITY ADVISORY

GHSA-667r-xxjv-c9mm HIGH

fastify vulnerable to request body replacement via an async validation result collision

AFFECTED PACKAGES:
NPM / fastify
< 5.12.2
Fixed in: 5.12.2

> HISTORIQUE DES MODIFICATIONS

Première apparition
27/05/2026 05:16
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-73: External Control of File Name or Path - The product allows user input to control or influence paths or file names that are used in filesystem operations. | CWE-78: Improper Neutralization of S...
Nouvelle valeur:
CWE-73: External Control of File Name or Path - The product allows user input to control or influence paths or file names that are used in filesystem operations. | CWE-78: Improper Neutralization of S...
📊 ENRICHISSEMENT 01/06/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-73: External Control of File Name or Path - The product allows user input to control or influence paths or file names that are used in filesystem operations. | CWE-78: Improper Neutralization of S...
Total des modifications: 2 Dernière mise à jour: 6 days ago

> REFERENCES

https://github.com/libwww-perl/HTTP-Daemon/commit/945d35141d94490f749640bd4390ac...
https://github.com/libwww-perl/HTTP-Daemon/pull/89
https://metacpan.org/release/OALDERS/HTTP-Daemon-6.17/changes
« BACK_TO_HOME