Critical Vulnerability in perl-IO-Compress: Arbitrary Code Execution Risk
Summary
RLSA-2026:30858: Important: perl-IO-Compress security update. Affects perl-IO-Compress versions < 0:2.081-2.el8_10. Fixed in 0:2.081-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-IO-Compress is a Perl module that provides an interface for reading and writing compressed data using zlib and bzip2 libraries. It supports various compression formats including bzip2, gzip, and zip files. This module is essential for applications that handle compressed data, making it widely used in various software environments. However, a recent security issue has been identified that could allow attackers to execute arbitrary code through manipulated output glob patterns.
Vulnerability Detail
The vulnerability, identified as CVE-2026-48962, allows for arbitrary code execution via attacker-controlled output glob. This means that an attacker could potentially exploit this flaw to execute malicious code on a system that uses the affected version of perl-IO-Compress. The risk is particularly high as it can lead to unauthorized access and control over the affected systems, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
0:2.081-2.el8_10
This is the first release that contains the fix.
sudo dnf update perl-IO-CompressTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected features of perl-IO-Compress until the package is updated. However, it is strongly recommended to apply the patch as soon as possible to mitigate the risk of exploitation.
Conclusion
The perl-IO-Compress module has a critical vulnerability that poses a significant risk of arbitrary code execution. Users are urged to update to the patched version immediately to protect their systems. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for perl-IO-Compress →
FAQ
CVE-2026-48962 is a security vulnerability in the perl-IO-Compress module that allows for arbitrary code execution through attacker-controlled output glob patterns.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for this vulnerability is 7.8, indicating a high level of risk associated with its exploitation.
If you cannot update the package right away, avoid using the features of perl-IO-Compress that are affected by this vulnerability until a fix can be applied.
More details can be found on the CVE page for CVE-2026-48962, which includes information about the impact, acknowledgments, and related security issues.
Related vulnerabilities
Recent vulnerabilities recorded for perl-IO-Compress.
