Medium [CVE-2026-15392] DBD::File: Arbitrary file read/write via symlink vulnerability
This medium-severity Red Hat Linux advisory covers CVE-2026-15392 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link.
A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.
This oversight allows a local attacker to create a symbolic link within the data directory that points to an arbitrary file outside of the intended data storage. Consequently, file-based drivers can be tricked into reading from or writing to unauthorized files, potentially leading to information disclosure or data corruption.
This Moderate flaw in DBD::File allows a local attacker to achieve arbitrary file read and write access. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L).
Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: perl-dbi.
- < 1.651
Official advisory · high-confidence parse· fetched 4 days ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 4 days ago·verify at source
Mitigation checklist
- To mitigate this issue, ensure that directories used by applications using `DBD::File` for data storage have restricted write permissions, preventing untrusted local users from creating symbolic links. This operational control limits an attacker's ability to exploit the vulnerability by preventing the creation of malicious symlinks.
Official advisory · high-confidence parse· fetched 4 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.