CVE-2026-11527: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle

Synopsis

OS command injection and file overwrite vulnerability in Config::IniFiles (Perl) before version 3.001000. The flaw is reached locally when a user or process supplies input that is forwarded to the -file argument, and no authentication is required to trigger it, though the attacker must cause a victim to pass a crafted filename. Successful exploitation lets an attacker execute arbitrary OS commands or overwrite files under the process UID. A patched-image rebuild at version 3.001000 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; this is a local attack vector and no network path to the service is required.

• AuthenticationNot required

  No account or credential is required to supply the malicious -file argument; the attacker only needs the ability to influence the filename passed to Config::IniFiles.

• Victim interactionRequired

  A victim process or user must pass attacker-controlled input as the -file argument to Config::IniFiles::new, making this a social-engineering or input-injection scenario rather than a fully autonomous attack.

• Attack complexityDetail

  Attack complexity is low: no race condition, memory-layout dependency, or other environmental precondition is required beyond supplying a pipe- or redirect-prefixed filename string.

Blast Radius

• Executes arbitrary OS commands under the UID of the process running Config::IniFiles, giving the attacker the same filesystem and process privileges as the application.
• Truncates or overwrites arbitrary files accessible to the process UID, enabling destruction or replacement of configuration, credential, or data files.
• Reads file contents or exfiltrates data by piping output to attacker-controlled destinations via the injected command.
• Achieves scope change (CVSS S:C): impact extends beyond the vulnerable component itself to other resources on the host accessible under the same UID.