CVE-2026-103508
Received Received - Intake

Authenticated Code Execution via Malicious Logging Config in P4 Search

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Perforce

Description
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-103508
EUVD
EUVD-2026-102074

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Perforce P4 (Helix core) 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated administrator on a P4 Server to craft a malicious logging configuration for P4 Search. This can cause the system to write or delete files outside the intended logging directory, potentially leading to code execution with the privileges of the P4 Search service account.

Impact Analysis

If exploited, this vulnerability could allow an attacker with administrative access to execute arbitrary code on the system running P4 Search. This may lead to unauthorized data access, system compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Organizations using affected versions may face regulatory penalties or reputational damage.

Mitigation Strategies

Update P4 Search to version 2026.4.3 or later to resolve the vulnerability. Ensure only trusted administrators have access to administrative privileges on the P4 Server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart