PT-2026-48114 · Petdance+5 · App::Ack+2

Marcin Wyczechowski + 1 · CVE-2026-49145 · Published 2026-06-08 · Updated 2026-07-08

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions App::Ack versions prior to 3.10.0

Description The software searches the directory hierarchy for a project .ackrc file and loads its options. Because the project-source option blocklist in App::Ack::ConfigLoader does not include the --files-from parameter, a maliciously crafted .ackrc file in an untrusted repository can specify a path to arbitrary files. This allows the application to read and print matching lines from files located outside the project directory.

Recommendations Update to version 3.10.0 or later.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-73

CWE-426

Related Identifiers

CVE-2026-49145

OPENSUSE-SU-2026:10965-1

Affected Products

App::Ack

Ack

Ack3

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49145.json · Exploit
• https://ubuntu.com/security/CVE-2026-49145 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49145 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10965-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-49145 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-49145 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2026-49145 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-49145 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-49145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49145 · Security Note
• https://github.com/beyondgrep/ack3 · Note
• https://suse.com/security/cve/CVE-2026-49145 · Note
• https://suse.com/security/cve/CVE-2026-49147 · Note
• http://openwall.com/lists/oss-security/2026/07/08/7 · Note
• https://cpan.org/modules · Note