Executive brief
A vulnerability in the HTTP::Daemon Perl library could allow an attacker to execute arbitrary commands on a server. This library is used to create simple web server applications; if an application uses the library to serve files based on user-provided names, an attacker can bypass security checks to run malicious code, steal data, or modify files. This could lead to a full system compromise or unauthorized access to sensitive business information.
Technical details
The send_file() function in HTTP::Daemon (specifically within HTTP::Daemon::ClientConn) used Perl's 2-argument open() function to handle file paths. In Perl, the 2-argument open() interprets certain characters as "magic" prefixes; for example, a path ending in a pipe character ('|') is executed as a system command. If an application passes untrusted user input (such as a query parameter) directly to send_file(), a remote attacker can achieve Remote Code Execution (RCE), exfiltrate command output via the HTTP response, or create/truncate arbitrary files on the filesystem. The vulnerability is fixed in version 6.17 by migrating to the 3-argument open() syntax, which treats the path as a literal string.
Affected products
- libwww-perl HTTP::Daemon < 6.17
Timeline
- 2026-05-14: patched: Initial fix committed to repository
- 2026-05-19: advisory: Version 6.17 released on MetaCPAN
- 2026-05-27: disclosed: CVE-2026-8450 published to NVD