Critical Security Flaw in perl-IO-Compress: Arbitrary Code Execution Risk
Summary
ALSA-2026:30860: Important: perl-IO-Compress security update. Affects perl-IO-Compress versions < 2.212-512.el10_2.1. Fixed in 2.212-512.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-IO-Compress is a Perl module that provides an interface for reading and writing compressed data using zlib and bzip2 libraries. It supports various compression formats, including bzip2, gzip, and zip files. This module is essential for applications that handle compressed data, allowing developers to easily integrate compression functionality into their Perl applications. However, a recent vulnerability has been identified that could allow attackers to execute arbitrary code through manipulated output glob patterns.
Vulnerability Detail
The vulnerability, identified as CVE-2026-48962, allows for arbitrary code execution due to improper handling of attacker-controlled output glob patterns in perl-IO-Compress. This flaw can be exploited by an attacker to execute malicious code on the affected system, potentially leading to unauthorized access, data breaches, or further exploitation of the system. The issue arises from the way the module processes output file names, making it susceptible to crafted input that can manipulate the execution flow.
How To Fix
Minimum fixed version
2.212-512.el10_2.1
This is the first release that contains the fix.
sudo dnf update perl-IO-CompressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the use of the perl-IO-Compress module in your applications until the package is updated. Additionally, ensure that your application does not process untrusted input that could lead to the exploitation of this vulnerability.
Conclusion
The perl-IO-Compress module has a critical vulnerability (CVE-2026-48962) that poses a significant risk of arbitrary code execution. It is crucial for users of this module to update to the latest patched version to protect their systems. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for perl-IO-Compress →
FAQ
CVE-2026-48962 is a security vulnerability in the perl-IO-Compress module that allows for arbitrary code execution through attacker-controlled output glob patterns.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized code execution, data breaches, and compromise of the affected system.
Yes, a patched version of perl-IO-Compress (2.212-512.el10_2.1) is available. Updating to this version will fix the vulnerability.
If immediate updates are not possible, consider restricting the use of the perl-IO-Compress module and avoid processing untrusted input to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for perl-IO-Compress.
