CVE-2026-15392 DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location
Attackers can read or write arbitrary files outside the data directory via symlink traversal in the Perl DBD::File library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15392?
CVE-2026-15392 is a high-severity path traversal vulnerability in HMBRAND DBD::File, published on 14 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.
The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.
Callers of file-based drivers can read or write files outside of the data directory.
Which versions are affected by CVE-2026-15392?
How do I fix CVE-2026-15392?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-15392 being exploited?
There is no known exploitation of CVE-2026-15392 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-15392, AZL-92424, BELL-CVE-2026-15392, DEBIAN-CVE-2026-15392, ECHO-aac2-eba6-686e, GHSA-mh3j-xwf4-jrqw and 2 more.