EulerOS 2.0 SP15 : perl-IO-Compress (EulerOS-SA-2026-3814)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.x000D...

CVE-2026-48962

摘要 File::GlobMapper::getFiles 中存在一个 eval 注入漏洞，允许任何能够控制传递给 IO::Compress::Gzip::gzip、IO::Compress::Zip::zip 或任何同类函数的输出文件通配符参数的攻击者，在运行进程的上下文中执行任意 Perl 代码。无需认证。影响是全面的：主机进程的机密性、完整性和可用性完全受损。 详情 File::GlobMapper::parseOutputGlob 通过将调用者提供的输出模式包裹在 Perl 双引号中并将结果存储来构建输出文件名模板。然后 getFiles 将该字符串直接传递给...

Astra Linux – Vulnerability in libio-compress-perl

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. The parseOutputGlob function wraps the output glob string provided by the caller within double quotes and stores it in the parser state. Then, the getFiles function...

EulerOS 2.0 SP12 : perl-IO-Compress (EulerOS-SA-2026-3370)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

EulerOS 2.0 SP12 : perl-IO-Compress (EulerOS-SA-2026-3295)

According to the versions of the perl-IO-Compress packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob...

📄 Perl IO::Compress Code Execution

This Metasploit auxiliary module targets a remote code execution vulnerability in Perl's IO::Compress, specifically through an eval injection issue in File::GlobMapper::getFiles...

Oracle Linux 9 : perl-IO-Compress (ELSA-2026-30859)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-30859 advisory. - Fix CVE-2026-48962: remove use of eval in File::GlobMapper Tenable has extracted the preceding description block directly from the Oracle Linux security...

OESA-2026-2610 perl-IO-Compress security update

This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. Security Fixes: IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob...

AZL-89280 CVE-2026-48962 affecting package perl for versions less than 5.38.2-512

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through eval...

CVE-2026-48962

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through eval...

UBUNTU-CVE-2026-48962

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through eval...

CVE-2026-48962 IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through eval...

CVE-2026-48962 IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. parseOutputGlob wraps the caller-supplied output glob string in double quotes and stores it in the parser state; getFiles then runs the stored expression through eval...