EUVD-2026-92311
GHSA-49f3-gp89-25v9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires super-user/service-token privileges so PR:H; network-reachable service feature gives AV:N/AC:L; arbitrary file write affects integrity and availability (I:L/A:L) but not confidentiality (C:N).
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
AnalysisAI
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or service-token privileges to write files with attacker-controlled content into the P4 Search installation directory via the extension installation feature, which fails to validate supplied file names (CWE-73). The vulnerability is authenticated and gated by a PR:H requirement, so exploitation is not possible for unauthenticated or low-privileged users; the realistic risk is confined to malicious insiders, abused service tokens, or an attacker who has already compromised a privileged account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess super-user or service-token privileges on P4 Search and to use its extension installation feature, which does not validate supplied file names (CWE-73). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a medium-severity issue (vendor CVSS 4.0 base 5.1) whose real-world risk is substantially gated by its precondition: the CVSS vector specifies PR:H, and the description confirms the attacker must already hold super-user or service-token privileges on P4 Search. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade P4 Search to 2026.4.2 or later, which the vendor states enforces file-name validation in the extension installation feature; consult the advisory at https://portal.perforce.com/s/cve/a91Qi000003FDpdIAG/arbitrary-filewrite-via-extension-installation-in-p4search for the exact download and configuration steps. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in P4 Helix Core
View allUnauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images pri
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exp
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remo
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Se
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today