PT-2025-23919 · Unknown+9 · File::Find::Rule+9
Published
2025-06-05
·
Updated
2025-11-12
·
CVE-2011-10007
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
File::Find::Rule versions through 0.34
Description
The issue allows for Arbitrary Code Execution when the
grep() function encounters a crafted filename. This is due to a file handle being opened with the 2 argument form of open(), allowing an attacker-controlled filename to provide the MODE parameter to open(), effectively turning the filename into a command to be executed. For example, if a directory contains a file named "|id", the id command will be executed when grep() is called on that directory.Recommendations
For versions through 0.34, consider disabling the
grep() function in File::Find::Rule until a patch is available, or restrict the use of open() with the 2 argument form to prevent attacker-controlled filenames from being executed as commands. Avoid using crafted filenames that could be interpreted as commands when using the grep() function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
File::Find::Rule
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu