CVE-2011-10007 Command injection in File::Find::Rule
Attackers can execute arbitrary commands via crafted filenames when using the grep method in the Perl File::Find::Rule library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-10007?
CVE-2011-10007 is a high-severity command injection vulnerability in RCLAMP File::Find::Rule, published on 5 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename.
A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed.
Example:
$ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)
Weakness: CWE-78
Which versions are affected by CVE-2011-10007?
Linux distribution packages (27)
perl-File-Find-Rule AlmaLinux:8 | All versions | 0.34-9.el8_10 |
perl-File-Find-Rule AlmaLinux:9 | All versions | 0.34-19.1.el9_6 |
perl-File-Find-Rule Red Hat:enterprise_linux:8::crb | All versions | 0:0.34-9.el8_10 |
perl-File-Find-Rule Red Hat:enterprise_linux:9::crb | All versions | 0:0.34-19.1.el9_6 |
perl-File-Find-Rule Red Hat:rhel_els:7 | All versions | 0:0.33-5.el7_9.1 |
perl-File-Find-Rule-Perl Red Hat:rhel_els:7 | All versions | 0:1.13-2.el7_9.1 |
perl-File-Find-Rule Red Hat:rhel_eus:9.4::crb | All versions | 0:0.34-19.el9_4.1 |
perl-File-Find-Rule Rocky Linux:8 | All versions | 0:0.34-9.el8_10 |
perl-File-Find-Rule Rocky Linux:9 | All versions | 0:0.34-19.1.el9_6 |
perl-File-Find-Rule SUSE:Enterprise Storage 7.1 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Manager Proxy 4.3 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule SUSE:Manager Server 4.3 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule openSUSE:Leap 15.6 | All versions | 0.34-150000.3.3.1 |
perl-File-Find-Rule openSUSE:Tumbleweed | All versions | 0.350.0-1.1 |
How do I fix CVE-2011-10007?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2011-10007 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2011-10007 exists.
Sources
Also known as ALSA-2025:9517, ALSA-2025:9605, AZL-62239, AZL-62273, DEBIAN-CVE-2011-10007, DLA-4209-1 and 20 more.