Path Traversal in Perforce P4 Search

Executive Summary

Perforce P4 Search before version 2026.4.2 has a flaw where file paths are not properly restricted in its logging configuration interface. An attacker with the service authentication token can exploit this to write arbitrary files on the host system. This could allow the attacker to execute code with the permissions of the P4 Search service account.

Useful 0 Not Useful 0

Impact Analysis

If you use Perforce P4 Search prior to 2026.4.2, an attacker who gains access to the service authentication token could write malicious files to your system. This may lead to full compromise of the P4 Search service account, allowing the attacker to execute arbitrary code on your host.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Perforce P4 Search to version 2026.4.2 or later to address the file path restriction issue. Ensure the service authentication token is not exposed and restrict access to authenticated users only.

Useful 0 Not Useful 0