PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11527 SHLOMIF CVE debrief

CVE-2026-11527 is a vulnerability in Config::IniFiles versions before 3.001000 for Perl. The vulnerability allows for OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. This occurs because Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), allowing a filename that begins or ends with a pipe ( '| cmd', 'cmd |' ) or begins with a redirect ( '> path', '>> path' ) to be run as a command or redirect rather than opened as a file. Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.

Vendor
SHLOMIF
Product
Config::IniFiles
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-14
Original CVE updated
2026-06-19
Advisory published
2026-06-14
Advisory updated
2026-06-19

Who should care

Developers and administrators using Config::IniFiles versions before 3.001000 for Perl should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by the use of a 2-arg open() in Config::IniFiles::_make_filehandle, which allows for OS command injection and file overwrite. The -file argument in new(-file => $thing) reaches this helper through ReadConfig. An in-memory scalar reference (-file => $text) does not open a path and is unaffected.

Defensive priority

high

Recommended defensive actions

  • Update to Config::IniFiles version 3.001000 or later.
  • Validate and sanitize all input to the -file argument.
  • Use a secure method for opening files, such as using a 3-arg open().

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11527 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11527

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11527 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11527

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/shlomif/perl-Config-IniFiles/commit/3e48f9627fbba4dae5de35be1f735cdeb7e47fb8.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/SHLOMIF/Config-IniFiles-3.001000/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.