CVE-2026-103511: Arbitrary file-write via extension installation in P4Search
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perforce P4 Searchto a version that resolves this vulnerability.Fixed in 2026.4.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires super-user privileges or a service token. Attackers without either of these privileges are not described as able to use the vulnerable extension installation feature.
Which deployments are affected?
Perforce P4 Search versions prior to 2026.4.2 are affected. The provided information does not identify any configuration prerequisite beyond use of the extension installation feature.
What is the impact of successful exploitation?
An attacker can supply unvalidated file names during extension installation and write arbitrary-content files into the P4 Search installation directory.