This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-15392 →

ALPINE-CVE-2026-15392

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method build...

Original description

The description as published by the source.

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Alpine:v3.24 perl-dbi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-r0"}]}]

References

advisory security.alpinelinux.org