Critical Security Flaw in perl-IO-Compress: Arbitrary Code Execution Risk
Summary
ALSA-2026:30858: Important: perl-IO-Compress security update. Affects perl-IO-Compress versions < 2.081-2.el8_10. Fixed in 2.081-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-IO-Compress is a Perl module that provides an interface for reading and writing compressed data using zlib and bzip2 libraries. It supports various compression formats, including bzip2, gzip, and zip files. This module is essential for applications that require data compression and decompression functionalities. However, a recent vulnerability has been identified that could allow attackers to execute arbitrary code through manipulated output glob patterns.
Vulnerability Detail
The vulnerability, identified as CVE-2026-48962, allows for arbitrary code execution due to improper handling of attacker-controlled output glob patterns in the perl-IO-Compress module. This flaw can be exploited by an attacker to execute malicious code on the affected system, potentially leading to unauthorized access, data breaches, or system compromise. The risk is particularly high for applications that process untrusted input or data from external sources.
How To Fix
Minimum fixed version
2.081-2.el8_10
This is the first release that contains the fix.
sudo dnf update perl-IO-CompressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting the input sources to trusted data only, and implement input validation to mitigate the risk of exploitation until the package can be updated.
Conclusion
The perl-IO-Compress module has a critical vulnerability that could lead to arbitrary code execution. It is essential to update to the latest patched version to mitigate this risk. Users should also consider implementing workarounds to protect their applications until the update can be applied.
See every vulnerability recorded for perl-IO-Compress →
FAQ
CVE-2026-48962 is a security vulnerability in the perl-IO-Compress module that allows arbitrary code execution via attacker-controlled output glob patterns.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your manifest file.
The risks include unauthorized code execution, potential data breaches, and system compromise, especially if the application processes untrusted input.
You can update the package by running the command 'sudo dnf update perl-IO-Compress' in your terminal.
Yes, you can restrict input sources to trusted data and implement input validation to reduce the risk of exploitation until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for perl-IO-Compress.
