DBD::File CVE-2026-15392

Vendor-released patch: upgrade DBI/DBD::File to version 1.651 or later, which adds an explicit symlink check in complete_table_name (commit 96d62dfe4528bf56fe13f413ed323d4252531728); this is the primary fix and is documented in advisory GHSA-mh3j-xwf4-jrqw and the release notes at https://metacpan.org/release/HMBRAND/DBI-1.651/changes. Where immediate upgrade is not possible, restrict who can write into the configured f_dir and f_dir_search directories so untrusted users cannot plant symbolic links (trade-off: does not help if table names themselves are attacker-controlled), and validate or whitelist any user-supplied table names before passing them to file-based drivers (trade-off: application-specific and may reject legitimate names). Additionally, mount or place data directories on a filesystem/context where symlink creation by the service account is denied, and run the Perl process under a low-privilege account to limit what an escaped read/write can reach. See also the oss-security disclosure at https://seclists.org/oss-sec/2026/q3/145.