# CVE-2026-8704: Perl Crypt::DSA insecure file handling via 2-argument open

Source: https://junglewise.ai/threats/cve-2026-8704-perl-crypt-dsa-insecure-file-handling-via-2-argument-open  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-8704 · Severity: info · Published 2026-05-15

Crypt::DSA is a Perl library used for creating and verifying digital signatures. A security flaw in how the library handles file operations allows for the unintended modification of existing files on the system. This could potentially lead to data corruption or unauthorized changes to sensitive configuration files if an attacker can influence the file paths used by the library.

## Quick answers

**Is CVE-2026-8704 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8704 being exploited in the wild.

**How severe is CVE-2026-8704?** Informational severity, published 15 May 2026.

**Which products and versions are affected?** Perl CPAN Crypt::DSA through 1.19.

**Is there a fix for CVE-2026-8704?** A patch was published on 2026-05-15: Version 1.20 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8704 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-8704?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Crypt::DSA library (specifically in lib/Crypt/DSA/Key.pm) utilizes the legacy Perl 2-argument open() function instead of the secure 3-argument version. This vulnerability class, often associated with CWE-552, occurs because the 2-argument form of open() interprets special characters (like '>' or '|') in the filename string, which can be exploited to truncate or overwrite existing files. An attacker who can control the filename passed to key loading or saving functions could potentially modify arbitrary files with the permissions of the Perl process. The issue is addressed in version 1.20.

## Affected products

- Perl CPAN Crypt::DSA through 1.19

## Timeline

- 2026-05-15: disclosed: CVE published to NVD
- 2026-05-15: patched: Version 1.20 released to address the issue

## References

- [https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes](https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/changes)
- [https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19](https://metacpan.org/release/TIMLEGGE/Crypt-DSA-1.20/diff/TIMLEGGE/Crypt-DSA-1.19)