IO::Compress CVE-2026-48962

IO::Compress is a core Perl distribution that provides gzip/zip/bzip2 compression interfaces, and it bundles File::GlobMapper - a helper that maps input filename globs to output filenames (e.g. globmap('*.tmp','X-#1')). Internally, _parseOutputGlob() built the output transformation by string-concatenating the caller-supplied glob inside double quotes and storing it in the parser state; _getFiles() then evaluated that stored string with eval STRING to interpolate the capture tokens (#1, #2, *). This is a textbook CWE-95 (improper neutralization of directives in dynamically evaluated code, i.e. eval injection): because the glob is interpolated into code rather than treated as data, any Perl syntax it contains is executed. The 2.220 fix replaces eval STRING in _getFiles() with a delimiter-based substitution scheme using non-printable markers (\xFF/\xFE plus escape bytes) that performs the variable substitution without ever evaluating the string as code. No CPE strings were supplied in the source data; the affected scope is taken from the ENISA EUVD range (IO::Compress < 2.220).