CVE-2026-8450 HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()
Attackers can execute OS commands, read files, or write files via send_file() in HTTP::Daemon due to unsafe Perl open() usage.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8450?
CVE-2026-8450 is a critical command injection vulnerability in OALDERS HTTP::Daemon, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
Which versions are affected by CVE-2026-8450?
Linux distribution packages (26)
perl-HTTP-Daemon AlmaLinux:10 | All versions | 6.16-7.el10_2.1 |
perl-HTTP-Daemon AlmaLinux:8 | All versions | 6.01-24.el8_10 |
perl-HTTP-Daemon AlmaLinux:9 | All versions | 6.12-6.el9_8.1 |
perl-HTTP-Daemon Red Hat:enterprise_linux:10.2 | All versions | 0:6.16-7.el10_2.1 |
perl-HTTP-Daemon Red Hat:enterprise_linux:8::crb | All versions | 0:6.01-24.el8_10 |
perl-HTTP-Daemon Red Hat:enterprise_linux:9::crb | All versions | 0:6.12-6.el9_8.1 |
perl-HTTP-Daemon Rocky Linux:10 | All versions | 0:6.16-7.el10_2.1 |
perl-HTTP-Daemon Rocky Linux:8 | All versions | 0:6.01-24.el8_10 |
perl-HTTP-Daemon Rocky Linux:9 | All versions | 0:6.12-6.el9_8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server 12 SP5-LTSS | All versions | 6.01-9.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server 16.0 | All versions | 6.16-160000.3.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 6.01-9.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 6.01-150000.3.8.1 |
perl-HTTP-Daemon SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 6.16-160000.3.1 |
perl-HTTP-Daemon openSUSE:Leap 16.0 | All versions | 6.16-160000.3.1 |
perl-HTTP-Daemon openSUSE:Tumbleweed | All versions | 6.170.0-1.1 |
How do I fix CVE-2026-8450?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-8450 being exploited?
There is no known exploitation of CVE-2026-8450 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:36187, ALSA-2026:36188, ALSA-2026:36189, AZL-93024, DEBIAN-CVE-2026-8450, GHSA-3hc6-3p33-wq57 and 14 more.