# CVE-2026-48962: Perl IO::Compress eval injection in File::GlobMapper

Source: https://junglewise.ai/threats/cve-2026-48962-perl-io-compress-eval-injection-in-file-globmapper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-05-27  
License: CC BY 4.0 with a link back

CVE-2026-48962 · Severity: info · CVSS 0 · Published 2026-05-27

A vulnerability in a common Perl library used for file compression could allow an attacker to execute malicious code. By providing a specially crafted file naming pattern (glob), an attacker can break out of the intended command and run arbitrary instructions with the same permissions as the application. This could lead to a full system compromise or unauthorized data access depending on the application's privileges.

## Quick answers

**Is CVE-2026-48962 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48962 being exploited in the wild.

**How severe is CVE-2026-48962?** Informational severity, with a CVSS score of 0, published 27 May 2026.

**Which products and versions are affected?** Perl CPAN IO::Compress before 2.220.

**Is there a fix for CVE-2026-48962?** A patch was published on 2026-05-16: Fix committed in version 2.220 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48962 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-48962?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An eval injection vulnerability exists in the File::GlobMapper component of the IO::Compress Perl library. The _parseOutputGlob() function wraps user-supplied output glob strings in double quotes and stores them; subsequently, the _getFiles() function executes this stored expression using 'eval STRING'. An attacker can provide a glob string containing a literal double quote to terminate the intended string wrapper and inject arbitrary Perl code. This code executes with the privileges of the process calling the library. The issue was resolved in version 2.220 by removing the use of eval in favor of a manual transformation logic.

## Affected products

- Perl CPAN IO::Compress before 2.220

## Timeline

- 2026-05-16: patched: Fix committed in version 2.220
- 2026-05-27: disclosed: CVE-2026-48962 published

## References

- [https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch](https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch)
- [https://metacpan.org/release/PMQS/IO-Compress-2.220/changes](https://metacpan.org/release/PMQS/IO-Compress-2.220/changes)