CVE-2026-49145
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jul 8, 2026
CISA due date
—
The record
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | ack | 0 | 3.10.0-1.1 |
Related vulnerabilities
- CVE-2026-49146 App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context… Also affects ack
- CVE-2026-49147 App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences… Also affects ack
- CVE-2026-88899 knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request… CWE-73
- CVE-2026-53956 Rattler is a library that provides common functionality used within the conda ecosystem. CWE-73
- CVE-2026-79692 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-73
- CVE-2026-86995 n8n is an open source workflow automation platform. CWE-73
- CVE-2026-62804 External control of file name or path in Microsoft Office Word allows an unauthorized… CWE-73
- CVE-2026-81830 The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local… CWE-73