CVE-2026-11527
Description
A flaw was found in Config::IniFiles. This vulnerability allows an attacker to achieve OS command injection or overwrite files. By supplying untrusted input to the -file argument, an attacker can execute arbitrary commands or truncate files under the privileges of the application. This occurs because the _make_filehandle function misinterprets specially crafted filenames as system commands or file redirection operations.
Statement
No Red Hat product ships an exploitable instance of Config::IniFiles. The matching RPM (perl-Config-IniFiles) is present only in the optional, disabled-by-default CodeReady Linux Builder (CRB) repositories for RHEL 8 and RHEL 9 as a build-time dependency, and is never invoked with attacker-controlled -file input by Red Hat's build process. The EPEL package already ships the fixed version (3.001000). Only the Fedora package remains on a pre-fix version; that is delegated to Fedora's own security response.
Mitigation
Users on Fedora (or any pre-fix build) should avoid passing untrusted input to Config::IniFiles->new(-file => ...). Passing an in-memory scalar reference instead (-file => \$text) does not invoke the vulnerable code path and is unaffected. Upgrade to Config::IniFiles 3.001000+ once available.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
