PT-2025-23919 · Unknown+9 · File::Find::Rule+9

Published

2025-06-05

·

Updated

2025-11-12

·

CVE-2011-10007

CVSS v2.0

10

High

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions File::Find::Rule versions through 0.34
Description The issue allows for Arbitrary Code Execution when the grep() function encounters a crafted filename. This is due to a file handle being opened with the 2 argument form of open(), allowing an attacker-controlled filename to provide the MODE parameter to open(), effectively turning the filename into a command to be executed. For example, if a directory contains a file named "|id", the id command will be executed when grep() is called on that directory.
Recommendations For versions through 0.34, consider disabling the grep() function in File::Find::Rule until a patch is available, or restrict the use of open() with the 2 argument form to prevent attacker-controlled filenames from being executed as commands. Avoid using crafted filenames that could be interpreted as commands when using the grep() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

Related Identifiers

ALSA-2025:9517
ALSA-2025:9605
AZL-62239
AZL-62273
BDU:2025-12301
CESA-2025_9605
CVE-2011-10007
DLA-4209-1
DSA-5936-1
INFSA-2025_9517
INFSA-2025_9605
MGASA-2025-0278
OESA-2025-1646
OESA-2025-1678
OESA-2025-1679
OESA-2025-1680
OESA-2025-1681
OESA-2025-2608
OPENSUSE-SU-2025:15260-1
RHSA-2025:9517
RHSA-2025:9605
RHSA-2025:9658
RHSA-2025:9740
RHSA-2025:9741
RHSA-2025_9517
RHSA-2025_9605
SUSE-SU-2025:02105-1
SUSE-SU-2025_02105-1
USN-7620-1

Affected Products

Almalinux
Astra Linux
Centos
File::Find::Rule
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu