EUVD-2026-92299
GHSA-w4rv-834f-h4j4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable config interface (AV:N/AC:L) but requires the privileged service token (PR:H) with no user interaction; arbitrary file write yielding service-account code execution gives C/I/A:H, scope unchanged.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
2DescriptionCVE.org
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.
AnalysisAI
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds a valid P4 Search service authentication token to dictate the file path used by the logging configuration interface and thereby write files anywhere on the host, which can escalate to code execution under the P4 Search service account. The flaw is a credentialed, privileged operation rather than an unauthenticated internet-facing attack: exploitation requires the service token, network reachability of the configuration interface, and a version older than the fixed 2026.4.2 release. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid P4 Search service authentication token and network access to its logging configuration interface, which must accept an attacker-controlled log file path that is not restricted/sanitized (CWE-73). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credentialed file-write-to-RCE flaw rated 7.5 (High). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade P4 Search to 2026.4.2 or later, which is the vendor-released fix version that adds the missing path restrictions on the logging configuration interface; this is the only complete remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every P4 Search deployment, confirm its exact version and flag any instance below 2026.4.2, and restrict network reachability of the configuration/logging interface to trusted administrative hosts only via firewall or ACL rules; in parallel, rotate the P4 Search service authentication token and move it into a managed secrets store rather than plaintext configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in P4 Helix Core
View allUnauthenticated network attackers can gain the highest application privileges on Perforce P4 Search container images pri
Unauthenticated remote code execution is possible in Perforce P4 Search container images prior to 2026.4.2 due to an exp
Perforce P4 Search before 2026.4.2 fails open when its service authentication token is blank, so an unauthenticated remo
Code injection vulnerability in the Command-Line Client of P4 Server (Helix Core) prior to version 2025.2 Patch 2 allows
Host-based authentication controls in Perforce P4 Search prior to 2026.4.2 can be bypassed because the service trusts a
Arbitrary file write in Perforce P4 Search versions prior to 2026.4.2 allows an attacker who already holds super-user or
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today