CVE-2026-15392: DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.651-1 - Upgrade
Upgrade
DBD::File (Perl)to a version that resolves this vulnerability.Fixed in 1.651
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15392?
The severity of CVE-2026-15392 is classified as high with a CVSS score of 7.7.
How do I fix CVE-2026-15392?
To fix CVE-2026-15392, upgrade DBD::File to version 1.651 or later.
What impact does CVE-2026-15392 have?
CVE-2026-15392 allows an attacker to exploit symlinks to access untrusted locations, potentially leading to exposure of sensitive data.
Which software is affected by CVE-2026-15392?
CVE-2026-15392 affects DBD::File versions prior to 1.651 for Perl.
What is the cause of CVE-2026-15392?
CVE-2026-15392 is caused by the complete_table_name method not verifying if a table file is a symbolic link.