CVE-2026-8450

Critical

Description

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.

SeverityCritical

CVSS9.1

Exploit probability—

ProductHTTP::Daemon

PublishedMay 27, 2026

First seenMay 27, 2026

Weakness typeCWE-78OS command injection CWE-73CWE-73

How to fix

Update

OALDERS HTTP::Daemon6.17 or later

Patches

github.com/libwww-perl/HTTP-Daemon/commit/945d35141d94490f749640bd4390acd6a2193995.patch

Vendor advisories

Affected products

Product	Affected versions	Fixed in
OALDERS HTTP::Daemon	v < 6.17	6.17

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.