CVE-2026-48962

What it actually does

IO::Compress for Perl before version 2.220 contains an injection flaw in File::GlobMapper. The vulnerable code places a caller-supplied output glob inside double quotes, stores that expression, and later evaluates it with Perl eval STRING. If an attacker can control the output glob value and include a literal double quote, they can break out of the intended quoted string and cause following text to be interpreted as Perl code. The injected Perl executes in the context of the process using the library, with that process's filesystem, network, and permission boundaries. Impact depends on how the consuming application exposes compression, archive, backup, file-conversion, or glob-mapping functionality, but can include unauthorized command execution, file read/write, data tampering, or service disruption.

Why it matters to the business

Applications or services that accept user-controlled file glob patterns and pass them into vulnerable IO::Compress/File::GlobMapper code may allow unauthenticated remote attackers to run code as the application process. This can lead to compromise of application servers, exposure or alteration of data accessible to the service account, interruption of business workflows that rely on Perl-based compression or file-processing jobs, and potential lateral movement if the affected process has broad permissions. The EPSS score is currently low and there is no known CISA KEV listing or reported ransomware use, but the bug is straightforward when the vulnerable call path is exposed, so internet-facing or automated file-processing services should still be prioritized for upgrade.

How an attack unfolds

An attacker first identifies an application, API, job runner, or file-processing workflow that uses IO::Compress/File::GlobMapper and allows an external party to influence the output glob argument. They then submit an output glob containing a double quote to terminate the library's intended quoted expression, followed by Perl syntax that performs the attacker's desired action. When the vulnerable application later calls the glob-mapping operation, _parseOutputGlob() stores the attacker-controlled expression and _getFiles() evaluates it using eval STRING. The injected Perl runs inside the application process, inheriting its privileges, environment variables, filesystem access, and network reachability. The attacker may use this to execute OS commands through Perl, modify files generated by the workflow, read application-accessible secrets, install persistence, or disrupt the service. Exploitability is highest where the output glob is accepted directly from unauthenticated network input or from untrusted archive/job metadata.

How to fix it

Upgrade IO::Compress to version 2.220 or later everywhere it is installed, including direct application dependencies, vendored Perl libraries, container images, build images, and system package installations. If using CPAN, update the IO::Compress distribution to 2.220 or newer and rebuild/redeploy affected applications. If using operating-system packages, apply the vendor security update that backports or includes the fix. If an immediate upgrade is not possible, prevent untrusted users from controlling output glob strings, reject literal double quotes and Perl metacharacter patterns in output glob inputs, avoid passing externally supplied glob expressions into File::GlobMapper, and run affected jobs with least-privilege service accounts in restricted execution environments. Treat input filtering as a temporary mitigation only; the durable fix is upgrading the library.

How to confirm the fix worked

Confirm that every runtime and build environment resolves IO::Compress to version 2.220 or later. Use Perl package inventory methods such as querying installed modules, checking CPAN dependency lock files, reviewing OS package versions, and inspecting container images. Verify that no application bundle or vendored library still contains an older IO::Compress release. Exercise representative compression or glob-mapping workflows after upgrade to ensure normal output glob handling still works. For exposure validation, review code paths for use of File::GlobMapper or IO::Compress APIs where output glob values originate from HTTP parameters, message queues, uploaded job files, archive metadata, configuration imports, or other untrusted sources. If temporary mitigations are deployed, test that inputs containing literal double quotes or Perl expression delimiters are rejected before reaching the library.

Typical attack path

1. Identify a Perl-based application or service that performs compression, archive, backup, file-conversion, or file glob mapping using IO::Compress/File::GlobMapper.
2. Find an input field, API parameter, job definition, configuration import, or metadata field that controls the output glob value.
3. Submit a crafted output glob containing a literal double quote that escapes the library's quoting context and appends Perl expressions.
4. Trigger the vulnerable file-mapping/compression operation so the stored output glob expression is processed.
5. The vulnerable _getFiles() path executes eval STRING on the attacker-influenced expression.
6. Injected Perl runs with the privileges of the calling process.
7. Use the resulting execution to read or alter accessible files, execute system commands, stage additional payloads, disrupt processing, or move laterally within reachable systems.

How to detect it

Because this is a library-level injection issue, there may be no universal product log entry proving exploitation. Detection should focus on applications that expose output glob configuration or file-processing job definitions. Review HTTP access logs, API gateway logs, application logs, job scheduler logs, message queue payload archives, uploaded configuration/job files, and audit logs for output glob values containing a literal double quote followed by Perl syntax, command execution functions, backticks, semicolons, pipe characters, or shell redirection. Correlate suspicious submissions with child process creation by Perl interpreters, unexpected outbound connections from Perl-based services, unusual file writes in application working directories, new cron/systemd/user startup artifacts, or errors mentioning eval, File::GlobMapper, _parseOutputGlob, or _getFiles. Endpoint telemetry should be queried for perl processes spawning shells, curl/wget, scripting interpreters, or system administration commands during or shortly after compression/glob-mapping requests. If application logs preserve request bodies or job definitions, inspect historical records from the time the vulnerable version was deployed through completion of the upgrade. Absence of these artifacts does not prove non-exploitation if inputs were not logged.

• File::GlobMapper
• _parseOutputGlob
• _getFiles
• eval STRING
• "; system(
• "; exec(
• "; qx(
• "; `
• "; open(
• "; unlink(
• "; chmod(
• "; chown(
• "; use Socket
• "; require Socket
• "; use MIME::Base64
• perl -e
• /bin/sh -c
• /bin/bash -c
• curl http
• wget http

What your security team should do

• Inventory all Perl applications, containers, job runners, and build systems for IO::Compress versions earlier than 2.220.
• Prioritize internet-facing services, self-service file-processing workflows, CI/CD jobs, backup/archive systems, and automation platforms where users can influence output filenames or glob patterns.
• Upgrade IO::Compress to 2.220 or later and redeploy affected applications from clean, patched build artifacts.
• Search source code for File::GlobMapper usage and confirm output glob values are not derived from untrusted input without strict validation.
• Until patched, block or reject output glob inputs containing literal double quotes or Perl execution metacharacter sequences, and disable exposed functionality if validation cannot be assured.
• Run affected services with least privilege and restrict outbound network access to reduce the blast radius of possible code execution.
• Review logs and job histories for suspicious output glob values submitted before patching, especially values containing double quotes followed by Perl keywords, command execution functions, or shell metacharacters.
• Monitor threat intelligence for any change in exploit maturity, EPSS trend, KEV status, or public proof-of-concept availability because exploitability can increase quickly for library-level injection flaws.