DBD::File CVE-2026-15392

Exploitation requires the use of a file-based DBI driver built on DBD::File (e.g. DBD::CSV/DBD::DBM) and the attacker's ability to place a symbolic link inside the configured f_dir/f_dir_search data directory, or to control the table name an application passes to such a driver. The malicious symlink must target a file the Perl process can otherwise access, and reads/writes execute with the privileges of that process. Limiting factors: the CVSS vector is AV:L (local, not network-reachable), so the attacker needs local filesystem write access to the data directory or an application path that forwards untrusted table names; deployments that never expose file-based drivers to untrusted input, or that keep f_dir writable only by trusted accounts, are not practically exploitable.

The supplied CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.7 High) reflects local access with high confidentiality and integrity impact and no availability impact, which matches a data-directory sandbox escape. However, PR:N is questionable: real exploitation requires either the ability to plant a symbolic link inside the data directory or an application that feeds attacker-controlled table names to a file-based driver, both of which typically imply some prior local access - so the effective privilege requirement is likely PR:L rather than PR:N. No EPSS score, KEV entry, or SSVC decision data was provided, so exploitation-probability signals are absent; the reporter is CPANSec and the issue is a defense-in-depth hardening of a library boundary rather than a remotely reachable service flaw. Net real-world priority is moderate: genuine impact where untrusted input reaches DBD::File table resolution or where an attacker already has write access to f_dir, but not an internet-facing mass-exploitation candidate.

An attacker who can write into a DBD::File data directory (or influence the table name a file-driver application opens) plants a symbolic link named like a table that points to a sensitive file such as /etc/passwd or an application config outside f_dir. When the application performs a SELECT or INSERT against that 'table,' DBD::File follows the link and reads or overwrites the external file with the process's privileges. No public proof-of-concept is identified at time of analysis, and the local attack vector with low complexity means the main gating factor is obtaining the initial directory write or table-name influence.