VulnSocial

CVE-2026-11527Disclosure

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. The helper is the open path behind the documented -file argument: new(-file => $thing) reaches it through ReadConfig. An in-memory scalar reference (-file => \$text) does not open a path and is unaffected. Any caller that forwards untrusted input to the -file argument can run an arbitrary command or truncate a file under the process UID.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-73CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • Peaked 2d ago at 2 mentions (2026-06-14); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-06-14: 2Mentions · 2026-06-18: 1Mentions · 2026-06-21: 1Technical Details · 2026-06-14: 2Technical Details · 2026-06-18: 1Technical Details · 2026-06-21: 106-1406-1806-21
Signal classification1 categories
Disclosure
4100.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-142
Disclosure2
2026-06-181
Disclosure1
2026-06-211
Disclosure1
Full discourse4 posts
  • Ferramentas Linux@Cezar_H_Linux
    Disclosure

    CVE-2026-11527: falha no libconfig-inifiles-perl do #Debian / #Ubuntu permite injeção de comandos via nomes de arquivo maliciosos. Saiba mais: -> http://tinyurl.com/u534n7ye https://t.co/2GJoydrPXh

    Post summary

    The tweet announces a command injection vulnerability (CVE‑2026‑11527) in libconfig-inifiles-perl on Debian/Ubuntu, providing a link for more information but no PoC, exploit tool, active exploitation or patch details.

    1000085
    1.5K followersView on X
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN CVE-2026-11526: GD before 2.86 allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle https://www.openwall.com/lists/oss-security/2026/06/14/4 CVE-2026-11527: Config::IniFiles before 3.001000 - ditto https://www.openwall.com/lists/oss-security/2026/06/14/5

    Post summary

    The post discloses two CVEs affecting Perl CPAN modules GD and Config::IniFiles, describing OS command injection and file overwrite via a flawed 2‑arg open() usage.

    1000070
    4.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-11527 Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config… https://www.cve.org/CVERecord?id=CVE-2026-11527

    Post summary

    The post announces CVE-2026-11527, which affects Config::IniFiles (Perl) by enabling OS command injection and file overwrite when using a 2‑argument open() call on the -file argument.

    00000146
    57.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-11527 OS Command Injection and File Overwrite in Config::IniFiles Before 3.001000 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11527

    Post summary

    The text announces the discovery of CVE‑2026‑11527, detailing it as an OS Command Injection and File Overwrite vulnerability in Config::IniFiles prior to version 3.001000, with no evidence of PoC, exploitation, or patch information.

    0000048
    4.0K followersView on X

Explore more

Back to dashboard