CVE-2026-8450
Command Injection in HTTP::Daemon Perl Module
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| libwww-perl | http_daemon | to 6.17 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8450 is a vulnerability in the HTTP::Daemon Perl module, specifically in versions before 6.17. It arises from the send_file() method using Perl's two-argument open() function, which interprets special shell-magic prefixes in file path strings.
These prefixes include '| cmd' or 'cmd |' which open pipes to subprocesses, and '> path' or '>> path' which open files for writing or appending. If untrusted input is passed to send_file(), an attacker can execute arbitrary OS commands with the daemon's user privileges or create/truncate files at attacker-chosen paths.
The vulnerability allows remote code execution and file manipulation because the two-argument open() interprets the input as shell commands rather than literal file names.
How can this vulnerability impact me? :
This vulnerability can lead to remote code execution on the server running HTTP::Daemon, allowing attackers to run arbitrary OS commands with the daemon's user privileges.
Additionally, attackers can manipulate files by creating or truncating files at paths they choose, potentially leading to data loss, unauthorized data modification, or system compromise.
The read-pipe form of the exploit can also leak subprocess output into HTTP responses, potentially exposing sensitive information.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the send_file() method in HTTP::Daemon interpreting shell-magic prefixes in file paths, which can lead to OS command injection. Detection involves checking if the HTTP::Daemon version is before 6.17 and if the send_file() method is used with untrusted input that could contain shell-magic prefixes such as '| cmd', 'cmd |', '> path', or '>> path'.
To detect exploitation attempts on your system or network, you can monitor HTTP requests for suspicious file path parameters containing these shell-magic prefixes.
- Use network monitoring tools or web server logs to search for requests with file paths starting with '|', ending with '|', or containing '>' or '>>'.
- Example command to search logs for suspicious patterns (assuming Apache logs):
- grep -E '\| |\|$|> |>> ' /var/log/apache2/access.log
- Check the installed version of HTTP::Daemon to confirm if it is vulnerable:
- perl -MHTTP::Daemon -e 'print $HTTP::Daemon::VERSION, "\n"'
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade HTTP::Daemon to version 6.17 or later, where the send_file() method has been fixed to use a three-argument open() call that treats file paths as literal filenames, preventing shell-magic interpretation.
Additionally, ensure that any input passed to send_file() is properly validated and sanitized to prevent injection of shell-magic prefixes or directory traversal.
- Upgrade HTTP::Daemon to version 6.17 or newer.
- Validate and sanitize all user-controlled input used in file paths.
- Review application code to avoid passing untrusted input directly to send_file().
- Apply the official patch that replaces the two-argument open() with a three-argument open() and includes additional hardening.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in HTTP::Daemon's send_file() method allows OS command injection and arbitrary file writes when untrusted input is passed, potentially leading to unauthorized access, data manipulation, or data leakage.
Such unauthorized access or data exposure could impact compliance with standards like GDPR or HIPAA, which require protection of sensitive data and prevention of unauthorized system access.
However, the provided information does not explicitly discuss compliance impacts or regulatory considerations.