synced 8 MIN AGO
01 Record

CVE-2026-48962

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

HighPUBLISHEDCNA: CPANSec
CNA base score7.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
View raw JSON

02 Description

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

03 Exploitation and scoring

Exploitation
Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
SSVC decision
  • ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
  • AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
  • Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
0.43% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 37.9% of scored records. A rank, not a probability.
NVD base score
7.3 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD analysis status
Deferred. NVD last modified this record on 2026-08-05.
Red Hat severity
Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2026-05-27 03:12Z5 MO AGO
Last updated
2026-08-05 12:15Z2 MO AGO
Reserved
2026-05-26
Assigning CNA
CPANSec
Record state
PUBLISHED
Severity
High (CVSS 7.3)
CNA CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
  • CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Variant
  • CWE-94Improper Control of Generation of Code ('Code Injection')Base
Data version
5.2
Document digest
d79ebe9b3496bc417b1d5192a8174feaa98235070ee91d02a4c018a463bf6fd9

05 Affected products

VendorProductVersionsPlatforms
PMQSIO::Compress0 to < 2.220—

06 References

07 Remediation

Upgrade to IO-Compress 2.220 or later.

08 Fixed in

AlmaLinux 8

  • perl
    Fixed in 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-Algorithm-Diff
    Fixed in 1.1903-10.module_el8.6.0+2766+8bf0b7ce
  • perl-Archive-Tar
    Fixed in 2.38-4.module_el8.10.0+4205+6175afda
  • perl-Archive-Zip
    Fixed in 1.68-3.module_el8.6.0+2766+8bf0b7ce
  • perl-Attribute-Handlers
    Fixed in 1.01-474.module_el8.10.0+4162+0aac7c4c
  • perl-AutoLoader
    Fixed in 5.74-474.module_el8.10.0+4162+0aac7c4c
  • perl-AutoSplit
    Fixed in 5.74-474.module_el8.10.0+4162+0aac7c4c
  • perl-B
    Fixed in 1.80-474.module_el8.10.0+4162+0aac7c4c
  • perl-Benchmark
    Fixed in 1.23-474.module_el8.10.0+4162+0aac7c4c
  • perl-CPAN
    Fixed in 2.28-5.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-DistnameInfo
    Fixed in 0.12-13.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-Meta
    Fixed in 2.150010-397.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-Meta-Requirements
    Fixed in 2.140-397.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-Meta-YAML
    Fixed in 0.018-1001.module_el8.6.0+2766+8bf0b7ce
  • perl-Carp
    Fixed in 1.50-439.module_el8.6.0+2766+8bf0b7ce
  • perl-Class-Struct
    Fixed in 0.66-474.module_el8.10.0+4162+0aac7c4c
  • perl-Compress-Bzip2
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.28-2.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.28-2.module_el8.6.0+3181+91434291
  • perl-Compress-Raw-Bzip2
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.096-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.096-1.module_el8.6.0+3181+91434291
  • perl-Compress-Raw-Lzma
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.096-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.096-1.module_el8.6.0+3181+91434291
  • perl-Compress-Raw-Zlib
    Fixed in 2.096-2.module_el8.10.0+3779+d5938d28
  • perl-Config-Extensions
    Fixed in 0.03-474.module_el8.10.0+4162+0aac7c4c
  • perl-Config-Perl-V
    Fixed in 0.32-441.module_el8.6.0+2766+8bf0b7ce
  • perl-DBM_Filter
    Fixed in 0.06-474.module_el8.10.0+4162+0aac7c4c
  • perl-DB_File
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1.855-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 1.855-1.module_el8.6.0+3181+91434291
  • perl-Data-Dumper
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.174-440.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.174-440.module_el8.6.0+3181+91434291
  • perl-Data-OptList
    Fixed in 0.110-7.module_el8.6.0+2766+8bf0b7ce
  • perl-Data-Section
    Fixed in 0.200007-8.module_el8.6.0+2766+8bf0b7ce
  • perl-Devel-PPPort
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.62-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 3.62-1.module_el8.6.0+3181+91434291
  • perl-Devel-Peek
    Fixed in 1.28-474.module_el8.10.0+4162+0aac7c4c
  • perl-Devel-SelfStubber
    Fixed in 1.06-474.module_el8.10.0+4162+0aac7c4c
  • perl-Devel-Size
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.83-3.module_el8.6.0+2766+8bf0b7ce
    • Affected before 0.83-3.module_el8.6.0+3181+91434291
  • perl-Digest
    Fixed in 1.20-1.module_el8.6.0+2766+8bf0b7ce
  • perl-Digest-MD5
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.58-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.58-1.module_el8.6.0+3181+91434291
  • perl-Digest-SHA
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:6.02-2.module_el8.6.0+2766+8bf0b7ce
    • Affected before 1:6.02-2.module_el8.6.0+3181+91434291
  • perl-DirHandle
    Fixed in 1.05-474.module_el8.10.0+4162+0aac7c4c
  • perl-Dumpvalue
    Fixed in 2.27-474.module_el8.10.0+4162+0aac7c4c
  • perl-DynaLoader
    Fixed in 1.47-474.module_el8.10.0+4162+0aac7c4c
  • perl-Encode
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4:3.08-461.module_el8.6.0+2766+8bf0b7ce
    • Affected before 4:3.08-461.module_el8.6.0+3181+91434291
  • perl-Encode-Locale
    Fixed in 1.05-10.module_el8.6.0+2766+8bf0b7ce
  • perl-Encode-devel
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4:3.08-461.module_el8.6.0+2766+8bf0b7ce
    • Affected before 4:3.08-461.module_el8.6.0+3181+91434291

182 further packages in AlmaLinux 8 not shown (first 40 listed).

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 9

  • perl-IO-Compress
    Fixed in 2.102-4.el9_8.1

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 10

  • perl-IO-Compress
    Fixed in 2.212-512.el10_2.1

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 8

  • perl
    Fixed in 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-Algorithm-Diff
    Fixed in 1.1903-10.module_el8.6.0+2766+8bf0b7ce
  • perl-Archive-Tar
    Fixed in 2.38-4.module_el8.10.0+4205+6175afda
  • perl-Archive-Zip
    Fixed in 1.68-3.module_el8.6.0+2766+8bf0b7ce
  • perl-Attribute-Handlers
    Fixed in 1.01-474.module_el8.10.0+4162+0aac7c4c
  • perl-AutoLoader
    Fixed in 5.74-474.module_el8.10.0+4162+0aac7c4c
  • perl-AutoSplit
    Fixed in 5.74-474.module_el8.10.0+4162+0aac7c4c
  • perl-B
    Fixed in 1.80-474.module_el8.10.0+4162+0aac7c4c
  • perl-Benchmark
    Fixed in 1.23-474.module_el8.10.0+4162+0aac7c4c
  • perl-CPAN
    Fixed in 2.28-5.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-DistnameInfo
    Fixed in 0.12-13.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-Meta
    Fixed in 2.150010-397.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-Meta-Requirements
    Fixed in 2.140-397.module_el8.6.0+2766+8bf0b7ce
  • perl-CPAN-Meta-YAML
    Fixed in 0.018-1001.module_el8.6.0+2766+8bf0b7ce
  • perl-Carp
    Fixed in 1.50-439.module_el8.6.0+2766+8bf0b7ce
  • perl-Class-Struct
    Fixed in 0.66-474.module_el8.10.0+4162+0aac7c4c
  • perl-Compress-Bzip2
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.28-2.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.28-2.module_el8.6.0+3181+91434291
  • perl-Compress-Raw-Bzip2
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.096-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.096-1.module_el8.6.0+3181+91434291
  • perl-Compress-Raw-Lzma
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.096-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.096-1.module_el8.6.0+3181+91434291
  • perl-Compress-Raw-Zlib
    Fixed in 2.096-2.module_el8.10.0+3779+d5938d28
  • perl-Config-Extensions
    Fixed in 0.03-474.module_el8.10.0+4162+0aac7c4c
  • perl-Config-Perl-V
    Fixed in 0.32-441.module_el8.6.0+2766+8bf0b7ce
  • perl-DBM_Filter
    Fixed in 0.06-474.module_el8.10.0+4162+0aac7c4c
  • perl-DB_File
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1.855-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 1.855-1.module_el8.6.0+3181+91434291
  • perl-Data-Dumper
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.174-440.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.174-440.module_el8.6.0+3181+91434291
  • perl-Data-OptList
    Fixed in 0.110-7.module_el8.6.0+2766+8bf0b7ce
  • perl-Data-Section
    Fixed in 0.200007-8.module_el8.6.0+2766+8bf0b7ce
  • perl-Devel-PPPort
    Fixed

    A version is affected if any line below covers it.

    • Affected before 3.62-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 3.62-1.module_el8.6.0+3181+91434291
  • perl-Devel-Peek
    Fixed in 1.28-474.module_el8.10.0+4162+0aac7c4c
  • perl-Devel-SelfStubber
    Fixed in 1.06-474.module_el8.10.0+4162+0aac7c4c
  • perl-Devel-Size
    Fixed

    A version is affected if any line below covers it.

    • Affected before 0.83-3.module_el8.6.0+2766+8bf0b7ce
    • Affected before 0.83-3.module_el8.6.0+3181+91434291
  • perl-Digest
    Fixed in 1.20-1.module_el8.6.0+2766+8bf0b7ce
  • perl-Digest-MD5
    Fixed

    A version is affected if any line below covers it.

    • Affected before 2.58-1.module_el8.6.0+2766+8bf0b7ce
    • Affected before 2.58-1.module_el8.6.0+3181+91434291
  • perl-Digest-SHA
    Fixed

    A version is affected if any line below covers it.

    • Affected before 1:6.02-2.module_el8.6.0+2766+8bf0b7ce
    • Affected before 1:6.02-2.module_el8.6.0+3181+91434291
  • perl-DirHandle
    Fixed in 1.05-474.module_el8.10.0+4162+0aac7c4c
  • perl-Dumpvalue
    Fixed in 2.27-474.module_el8.10.0+4162+0aac7c4c
  • perl-DynaLoader
    Fixed in 1.47-474.module_el8.10.0+4162+0aac7c4c
  • perl-Encode
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4:3.08-461.module_el8.6.0+2766+8bf0b7ce
    • Affected before 4:3.08-461.module_el8.6.0+3181+91434291
  • perl-Encode-Locale
    Fixed in 1.05-10.module_el8.6.0+2766+8bf0b7ce
  • perl-Encode-devel
    Fixed

    A version is affected if any line below covers it.

    • Affected before 4:3.08-461.module_el8.6.0+2766+8bf0b7ce
    • Affected before 4:3.08-461.module_el8.6.0+3181+91434291

182 further packages in CloudLinux 8 not shown (first 40 listed).

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 9

  • perl-IO-Compress
    Fixed in 2.102-4.el9_8.1

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 10

  • perl-IO-Compress
    Fixed in 2.212-512.el10_2.1

Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 12

  • libio-compress-perl
    Fixed in 2.204-1+deb12u1
  • perl
    Fixed in 5.36.0-7+deb12u4

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

  • libio-compress-perl
    Fixed in 2.213-1+deb13u1
  • perl
    Fixed in 5.40.1-6+deb13u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

  • libio-compress-perl
    Fixed in 2.220-1
  • perl
    Fixed in 5.40.1-8

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

  • libio-compress-perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

  • libio-compress-perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

  • libio-compress-perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • libio-compress-perl
    No fix yet
  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

  • libio-compress-perl
    No fix yet
  • perl
    Fixed in 5.38.2-3.2ubuntu0.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 25.10

  • libio-compress-perl
    No fix yet
  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.04 LTS

  • libio-compress-perl
    No fix yet
  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 26.10

  • libio-compress-perl
    No fix yet
  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 18.04 LTS

  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 20.04 LTS

  • perl
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.