The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.
Callers of file-based drivers can read or write files outside of the data directory.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| HMBRAND | DBD::File | unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to version 1.651 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 15 Jul 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Tue, 14 Jul 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory. | |
| Title | DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location | |
| Weaknesses | CWE-22 CWE-59 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-07-15T14:01:34.760Z
Reserved: 2026-07-10T12:52:40.335Z
Link: CVE-2026-15392
Vulnrichment
Updated: 2026-07-14T18:23:06.476Z
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.