Symlink Arbitrary File Access in DBD::File for Perl

Executive Summary

CVE-2026-15392 is a vulnerability in the DBD::File module for Perl, affecting versions before 1.651. The issue occurs because the module does not verify whether a table file is a symbolic link (symlink) pointing to an untrusted location outside the configured data directories.

The complete_table_name method constructs the absolute path of a table file without checking if it is a symlink. This allows an attacker to create a symlink inside the data directory that points to a file outside the allowed f_dir or f_dir_search directories. As a result, callers of file-based drivers can read or write files outside the intended data directory, leading to unauthorized file access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can check for the presence of symlinks in the configured data directories (f_dir and f_dir_search) of DBD::File that point outside the allowed paths. This requires inspecting the file system where the DBD::File module operates.

• Identify the configured data directories (f_dir and f_dir_search) in your DBD::File setup. These are typically defined in the application's configuration or code.
• Use the following command to list all symlinks in the data directory and check their targets: find /path/to/f_dir -type l -exec ls -l {} \;. Replace /path/to/f_dir with the actual path to your data directory.
• For each symlink found, verify if its target resolves to a location outside the allowed directories. You can use readlink -f /path/to/symlink to get the absolute path of the symlink target and compare it against the allowed directories.
• Check the installed version of DBD::File. If it is version 1.650 or earlier, it is likely vulnerable. You can use the following Perl command to check the version: perl -MDBD::File -e 'print $DBD::File::VERSION;'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways:

• Unauthorized file access: An attacker could read sensitive files outside the configured data directory, such as configuration files, credentials, or other confidential data.
• Unauthorized file modification: An attacker could modify or overwrite files outside the data directory, potentially altering database files or planting malicious files.
• Privilege escalation: If the DBI process runs with elevated privileges, the attacker could leverage this vulnerability to gain higher-level access to the system.

The impact depends on the permissions of the DBI process and the sensitivity of the files accessible on the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the vulnerability leads to unauthorized access or exposure of personal data, it could result in a data breach. GDPR requires organizations to implement appropriate security measures to protect personal data, and a failure to do so could lead to fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected system handles protected health information (PHI), unauthorized access or modification of such data could violate HIPAA's security and privacy rules. This could result in penalties and mandatory corrective actions.
• Other standards: Compliance frameworks like PCI DSS (Payment Card Industry Data Security Standard) or ISO 27001 require strict access controls and protection against unauthorized data access. This vulnerability could undermine those controls, leading to non-compliance.

Organizations using the vulnerable version of DBD::File should apply the patch or upgrade to a secure version to avoid potential compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade DBD::File to version 1.651 or later, which includes the fix for this vulnerability. This can be done using the Perl package manager: cpan DBD::File.
• If upgrading is not immediately possible, restrict write access to the data directories (f_dir and f_dir_search) to prevent attackers from creating symlinks. Use file system permissions to limit access: chmod 750 /path/to/f_dir.
• Audit the data directories for any existing symlinks that point outside the allowed paths. Remove or replace any such symlinks with regular files or valid symlinks within the allowed directories.
• Monitor the data directories for any new symlinks being created. Use tools like auditd or file integrity monitoring (FIM) solutions to detect and alert on symlink creation.
• Review the application's use of DBD::File to ensure it does not inadvertently allow user-controlled input to influence file paths, which could be exploited to create malicious symlinks.

Useful 0 Not Useful 0