Source: libio-compress-perl Version: 2.219-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for libio-compress-perl. CVE-2026-48962[0]: | IO::Compress versions before 2.220 for Perl can execute arbitrary | code in File::GlobMapper via an attacker-controlled output glob. | _parseOutputGlob() wraps the caller-supplied output glob string in | double quotes and stores it in the parser state; _getFiles() then | runs the stored expression through eval STRING. A literal double | quote in the output glob closes the dquote wrapper, and the | characters that follow are evaluated as Perl. Arbitrary Perl in the | output glob executes at the calling process's privilege. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-48962 https://www.cve.org/CVERecord?id=CVE-2026-48962 [1] https://lists.security.metacpan.org/cve-announce/msg/40434385/ [2] https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
