This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-15392 →

DEBIAN-CVE-2026-15392

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method build...

Original description

The description as published by the source.

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libdbi-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.643-4+deb12u2"}]}]

Debian:13 libdbi-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.652-2~deb13u1"}]}]

Debian:14 libdbi-perl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}]

References

advisory security-tracker.debian.org