Critical Security Flaw in perl-IO-Compress: Arbitrary Code Execution Vulnerability
Summary
RLSA-2026:30860: Important: perl-IO-Compress security update. Affects perl-IO-Compress versions < 0:2.212-512.el10_2.1. Fixed in 0:2.212-512.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-IO-Compress is a Perl module that provides an interface for reading and writing compressed data using zlib and bzip2 libraries. It supports various compression formats, including bzip2, gzip, and zip files. This package is essential for applications that require efficient data compression and decompression. However, a recent vulnerability has been identified that could allow attackers to execute arbitrary code through manipulated output glob patterns.
Vulnerability Detail
The vulnerability, identified as CVE-2026-48962, allows for arbitrary code execution via attacker-controlled output glob. This means that an attacker could potentially exploit this flaw to execute malicious code on a system that uses the affected version of perl-IO-Compress. The issue arises from improper handling of input data, which can lead to severe security implications, including unauthorized access and data breaches.
How To Fix
Minimum fixed version
0:2.212-512.el10_2.1
This is the first release that contains the fix.
sudo dnf update perl-IO-CompressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected features of perl-IO-Compress until the package is updated. Additionally, validate and sanitize all input data to mitigate the risk of exploitation.
Conclusion
The perl-IO-Compress package has a critical vulnerability (CVE-2026-48962) that allows for arbitrary code execution. Users are strongly advised to update to the latest patched version to secure their systems. In the meantime, implementing workarounds and validating input data can help mitigate risks.
See every vulnerability recorded for perl-IO-Compress →
FAQ
CVE-2026-48962 is a security vulnerability in perl-IO-Compress that allows for arbitrary code execution through attacker-controlled output glob.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized code execution, potential data breaches, and compromise of system integrity.
Yes, a patch is available in version 0:2.212-512.el10_2.1 of perl-IO-Compress. Users should update to this version to mitigate the risk.
If an immediate update is not possible, avoid using the affected features and ensure that all input data is validated and sanitized.
Related vulnerabilities
Recent vulnerabilities recorded for perl-IO-Compress.
