Executive brief
The DBD::File component in the Perl DBI library, which allows database-like access to flat files, fails to properly validate symbolic links. An attacker with the ability to create files in the database directory can use a symbolic link to trick the application into reading or writing files anywhere on the system that the application has permission to access. This could lead to the exposure of sensitive configuration files or the unauthorized modification of system data.
Technical details
A path traversal and link following vulnerability exists in DBD::File versions prior to 1.651. The `complete_table_name` method constructs absolute paths for table files without verifying if the target is a symbolic link. If an attacker can create a symlink within the configured `f_dir` or `f_dir_search` directories, they can point that link to any file on the filesystem. When the driver opens the "table," it follows the link, allowing local users to read or write files outside the intended data directory with the privileges of the Perl process. This is a residual gap from previous fixes for CVE-2014-10401 and CVE-2014-10402. The issue is resolved in version 1.651 by resolving the real path of the file and rejecting those that escape the configured directories.
Affected products
- HMBRAND DBI (DBD::File) < 1.651
Timeline
- 2026-07-10: other: Fix committed to repository
- 2026-07-14: patched: Version 1.651 released
- 2026-07-14: advisory: GitHub Security Advisory published
- 2026-07-14: disclosed: CVE published to NVD