CVE-2026-15392highCWE-22CWE-59

CVE-2026-15392: high-severity vulnerability in HMBRAND DBD::File

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

Published · Updated

Follow this CVE+ Monitor DBD::File+ Monitor libdbi-perl

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 0.2%
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
HMBRAND · DBD::File