CVE-2026-11527— Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1222 · File and Directory Permissions ModificationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SHLOMIF | Config::IniFiles | < 3.001000 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11527
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle
Source: NVD (National Vulnerability Database)
Vulnerability Description
Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => \$text) does not open a path and is unaffected. Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SHLOMIF Config::IniFiles 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SHLOMIF Config::IniFiles是SHLOMIF组织开源的一个Perl配置管理模块。 SHLOMIF Config::IniFiles 3.001000之前版本存在安全漏洞，该漏洞源于对-file参数使用2-arg open()，可能导致OS命令注入和文件覆盖。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SHLOMIF | Config::IniFiles | 0 ~ 3.001000 | - |
II. Public POCs for CVE-2026-11527
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11527
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-11527 (1)
Other References for CVE-2026-11527 (1)
- 🔗 Changes - metacpan.orgrelease-notes
IV. Related Vulnerabilities
Same weakness: CWE-78
V. Comments for CVE-2026-11527
No comments yet