Skip to content
Fencer Vulns
high 7.8

CVE-2026-48962 json

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

published 2026-05-27 5 mo ago modified 2026-08-05 3 mo ago also EUVD-2026-32048

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.

Arbitrary Perl in the output glob executes at the calling process's privilege.

Patch / fix

  • PMQS IO::Compress 2.220
  • Red Hat Red Hat Enterprise Linux 10 0:2.212-512.el10_2.1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:2.212-512.el10_0.1
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:2.061-2.el7_9.1
  • Red Hat Red Hat Enterprise Linux 8 0:2.081-2.el8_10, 8100020260616084412.651ee29f
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:2.081-1.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:2.081-1.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:2.081-1.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:2.081-1.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:2.081-1.el8_8.1, 8080020260622152847.3ba2f806
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:2.081-1.el8_8.1, 8080020260622152847.3ba2f806
  • Red Hat Red Hat Enterprise Linux 9 0:2.102-4.el9_8.1
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:2.102-4.el9_2.1
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:2.102-4.el9_4.1
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:2.102-4.el9_6.1
  • perl Debian 12 5.36.0-7+deb12u4
  • perl Debian 13 5.40.1-6+deb13u1
  • perl Debian 14 5.40.1-8
  • libio-compress-perl Debian 12 2.204-1+deb12u1
  • libio-compress-perl Debian 13 2.213-1+deb13u1
  • libio-compress-perl Debian 14 2.220-1

debian advisories DEBIAN-CVE-2026-48962

  • perl Ubuntu 24.04 LTS 5.38.2-3.2ubuntu0.4

ubuntu advisories UBUNTU-CVE-2026-48962

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl-IO-Compress RHEL 10.2 2.212-512.el10_2.1
  • perl-IO-Compress RHEL 9 2.102-4.el9_8.1
  • perl-IO-Compress RHEL 8 2.081-2.el8_10
  • perl RHEL 8 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
  • perl-B RHEL 8 1.80-474.module+el8.10.0+24099+8aa2f756
  • perl-if RHEL 8 0.60.800-474.module+el8.10.0+24099+8aa2f756
  • perl-IO RHEL 8 1.43-474.module+el8.10.0+24099+8aa2f756
  • perl-ph RHEL 8 5.32.1-474.module+el8.10.0+24099+8aa2f756

red hat advisories RHSA-2026:50262RHSA-2026:30860RHSA-2026:30859RHSA-2026:30858RHSA-2026:30851RHSA-2026:30843

  • perl-IO-Compress openSUSE Leap 16.0 2.220.0-bp160.1.1
  • perl-IO-Compress openSUSE Tumbleweed 2.220.0-1.1

opensuse advisories openSUSE-SU-2026:21177-1openSUSE-SU-2026:10939-1

  • perl AlmaLinux 8 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-B AlmaLinux 8 1.80-474.module_el8.10.0+4162+0aac7c4c
  • perl-if AlmaLinux 8 0.60.800-474.module_el8.10.0+4162+0aac7c4c
  • perl-IO AlmaLinux 8 1.43-474.module_el8.10.0+4162+0aac7c4c
  • perl-ph AlmaLinux 8 5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-Env AlmaLinux 8 1.04-396.module_el8.6.0+2766+8bf0b7ce
  • perl-lib AlmaLinux 8 0.65-474.module_el8.10.0+4162+0aac7c4c
  • perl-mro AlmaLinux 8 1.23-474.module_el8.10.0+4162+0aac7c4c

almalinux advisories ALSA-2026:30851ALSA-2026:30858ALSA-2026:30859ALSA-2026:30860

  • perl-IO-Compress Rocky Linux 8 2.081-2.el8_10
  • perl-IO-Compress Rocky Linux 10 2.212-512.el10_2.1
  • perl-IO-Compress Rocky Linux 9 2.102-4.el9_8.1
  • perl Rocky Linux 8 4:5.32.1-474.module+el8.10.0+40155+64ce2d41
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+1616+0d20cc68
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+40155+64ce2d41
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+878+f93dfff7
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+882+2fa1e48f

rocky linux advisories RLSA-2026:30858RLSA-2026:30860RLSA-2026:30859RLSA-2026:30851

  • perl Alpine 3.24 5.42.3-r0

alpine advisories ALPINE-CVE-2026-48962

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl Azure Linux 3.0 5.38.2-512

azure linux advisories AZL-89280

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-48962 updated cvss 7.8

perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob

  • Red Hat Enterprise Linux AppStream (v. 8) perl 5.32.1-474.module+el8.10.0+24099+8aa2f756, perl-B 1.80-474.module+el8.10.0+24099+8aa2f756, perl-URI 1.76-5.module+el8.10.0+21354+3ad137bb, perl-CPAN 2.28-5.module+el8.10.0+21354+3ad137bb, perl-IO 1.43-474.module+el8.10.0+24099+8aa2f756, perl-Tie 4.6-474.module+el8.10.0+24099+8aa2f756, +213 more
    fixed: vendor fix RHSA-2026:30851
  • Red Hat Enterprise Linux AppStream (v. 9) perl-IO-Compress 2.102-4.el9_8.1
    fixed: vendor fix RHSA-2026:30859
  • Red Hat Enterprise Linux AppStream (v. 10) perl-IO-Compress 2.212-512.el10_2.1
    fixed: vendor fix RHSA-2026:30860
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-IO-Compress 2.096-1.module+el8.8.0+24435+247ee4c9.1
    fixed: vendor fix RHSA-2026:50262
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perl-IO-Compress 2.102-4.el9_2.1
    fixed: vendor fix RHSA-2026:29210
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) perl-IO-Compress 2.102-4.el9_4.1
    fixed: vendor fix RHSA-2026:29182
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) perl-IO-Compress 2.212-512.el10_0.1
    fixed: vendor fix RHSA-2026:29941
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) perl-IO-Compress 2.102-4.el9_6.1
    fixed: vendor fix RHSA-2026:30085
show 10 more
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-IO-Compress 2.096-1.module+el8.8.0+24435+247ee4c9.1
    fixed: vendor fix RHSA-2026:50262
  • Red Hat Enterprise Linux BaseOS (v. 8) perl-IO-Compress 2.081-2.el8_10
    fixed: vendor fix RHSA-2026:30858
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) perl-IO-Compress 2.081-1.el8_4.1
    fixed: vendor fix RHSA-2026:29867
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) perl-IO-Compress 2.081-1.el8_6.1
    fixed: vendor fix RHSA-2026:30115
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) perl-IO-Compress 2.081-1.el8_8.1
    fixed: vendor fix RHSA-2026:30086
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) perl-IO-Compress 2.081-1.el8_4.1
    fixed: vendor fix RHSA-2026:29867
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) perl-IO-Compress 2.081-1.el8_6.1
    fixed: vendor fix RHSA-2026:30115
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) perl-IO-Compress 2.081-1.el8_8.1
    fixed: vendor fix RHSA-2026:30086
  • Red Hat Enterprise Linux Server (v. 7 ELS) perl-IO-Compress 2.061-2.el7_9.1
    fixed: vendor fix RHSA-2026:30843
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-URI 1.76-5.module+el8.6.0+13324+628a2397, perl-CPAN 2.28-5.module+el8.6.0+13324+628a2397, perl 5.32.1-472.module+el8.8.0+24404+b3ad2701.1, perl-B 1.80-472.module+el8.8.0+24404+b3ad2701.1, perl-Env 1.04-396.module+el8.6.0+13324+628a2397, perl-Carp 1.50-439.module+el8.6.0+13324+628a2397, +212 more Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-URI 1.76-5.module+el8.6.0+13324+628a2397, perl-CPAN 2.28-5.module+el8.6.0+13324+628a2397, perl 5.32.1-472.module+el8.8.0+24404+b3ad2701.1, perl-B 1.80-472.module+el8.8.0+24404+b3ad2701.1, perl-Env 1.04-396.module+el8.6.0+13324+628a2397, perl-Carp 1.50-439.module+el8.6.0+13324+628a2397, +212 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • PMQS IO::Compress
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support

Classification

Weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.