PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48962 PMQS CVE debrief

IO::Compress versions before 2.220 for Perl contain a code injection vulnerability in File::GlobMapper. The _parseOutputGlob() function wraps attacker-supplied output glob strings in double quotes and stores them in parser state; _getFiles() subsequently passes this stored expression through eval STRING. A literal double quote character in the output glob terminates the wrapper, allowing subsequent characters to be evaluated as arbitrary Perl code. This results in remote code execution at the privilege level of the calling process. The vulnerability is classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). A patch is available that addresses the unsafe eval usage.

Vendor
PMQS
Product
IO::Compress
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-08-05
Advisory published
2026-05-27
Advisory updated
2026-08-05

Who should care

Organizations running Perl applications that process compressed archives or use IO::Compress with potentially untrusted input paths; developers maintaining legacy Perl codebases; security teams monitoring for code injection in interpreted language environments

Technical summary

The vulnerability exists in File::GlobMapper's handling of output glob strings. The _parseOutputGlob() function takes a caller-supplied output glob, wraps it in double quotes, and stores it. When _getFiles() later executes eval STRING on this stored value, any embedded literal double quote in the original glob breaks out of the wrapper context. Characters following the injected quote are then evaluated as Perl code. This classic injection pattern allows complete control over the evaluated expression, leading to arbitrary code execution. The fix in version 2.220 eliminates the unsafe eval pattern.

Defensive priority

critical

Recommended defensive actions

  • Upgrade IO::Compress to version 2.220 or later
  • Review application code for any usage of File::GlobMapper with untrusted output glob inputs
  • Apply principle of least privilege to Perl processes handling compressed archives
  • Monitor for anomalous Perl eval execution in application logs
  • Validate and sanitize any user-supplied glob patterns before passing to IO::Compress functions

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry published 2026-05-27. Technical details confirmed via commit patch and changelog references. Vendor attribution to PMQS (Perl module maintainer) derived from Metacpan reference with low confidence requiring review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48962 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48962

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48962 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48962

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/PMQS/IO-Compress-2.220/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.