CVE-2026-15392

High

Description

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

SeverityHigh

CVSS7.7

Exploit probability—

ProductDBD::File

PublishedJul 14, 2026

First seenJul 14, 2026

Weakness typeCWE-22Path traversal CWE-59Improper link resolution

How to fix

Update

HMBRAND DBD::File1.651 or later

Patches

github.com/perl5-dbi/dbi/commit/96d62dfe4528bf56fe13f413ed323d4252531728.patch

Vendor advisories

Affected products

Product	Affected versions	Fixed in
HMBRAND DBD::File	v < 1.651	1.651

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.