Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-15392 →

ALPINE-CVE-2026-15392

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method build...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Alpine:v3.24 perl-dbi

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-r0"}]}]

Références

advisory security.alpinelinux.org