CVE-2026-15392
CVE-2026-15392: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.3
Medium [CVE-2026-15392] DBD::File: Arbitrary file read/write via symlink vulnerability
CVE-2026-15392Source published Source updated
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory. This oversight allows a local attacker to create a symbolic link within the data directory that points to an arbitrary file outside of the intended data storage. Consequently, file-based drivers can be tricked into reading from or writing to unauthorized files, potentially leading to information disclosure or data corruption. This Moderate flaw…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
2 more entries in the full advisory.
- Source-reported affected versions
- < 1.651
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- To mitigate this issue, ensure that directories used by applications using `DBD::File` for data storage have restricted write permissions, preventing untrusted local users from creating symbolic links. This operational control limits an attacker's ability to exploit the vulnerability by preventing the creation of malicious symlinks.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.