Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-27 | 1 | Disclosure1 |
| 2026-05-28 | 1 | Disclosure1 |
| 2026-07-27 | 2 | Disclosure1Patch1 |
CVE-2026-8450: HTTP::Daemon before 6.17 allow OS command injection via send_file() https://www.openwall.com/lists/oss-security/2026/05/27/5
Post summary
The post references CVE-2026-8450, noting an OS command injection flaw in HTTP::Daemon prior to 6.17 via send_file(), and links to an Openwall discussion thread.
古いPerl資産に、かなり嫌な穴が来た。 HTTP::Daemon 6.17未満のsend_file()は、filenameをPerlの2引数openで扱うため、細工された値をOS commandとして実行し得る（CVE-2026-8450）。外部入力がfilenameまで届く実装なら危険だ。 現場で怖いのは、古い監視・管理ツールの間接依存に埋もれること。自分なら各hostとcontainerで `perl -MHTTP::Daemon -e 'print "$HTTP::Daemon::VERSION\n"'` を実行し、`send_file`の呼び出し元も検索する。6.17以上かdistro修正版へ上げ、入力pathはcanonicalizeして許可directory配下に限定してほしい。CSIRTの初動確認用に保存推奨。 #セキュリティ ソース: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8450
Post summary
CVE-2026-8450 allows OS command execution in HTTP::Daemon < 6.17; the text advises users to upgrade or patch and to validate/limit file paths to mitigate the risk.
🚨 HTTP::Daemon before 6.17 turned send_file into a potential command launcher: old Perl open semantics plus attacker input is a terrible combo. Patch it before file delivery delivers shells. https://windowsforum.com/security-alerts.84/cve-2026-8450-http-daemon-6-17-fixes-remote-command-execution.440571/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #PerlSecurity #Cve20268450 #HttpDaemon https://t.co/ndkeNIkvuG
Post summary
A newly identified RCE flaw in HTTP::Daemon 6.17 and below allows attackers to spawn shells via send_file; users are urged to apply patches immediately.
CVE-2026-8450 (CVSS 9.1) impacts HTTP::Daemon < 6.17 for Perl with command injection risk via send_file(). Review dependencies and update if using this module. https://nvd.nist.gov/vuln/detail/CVE-2026-8450 http://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning
Post summary
The text reports a high‑severity command injection vulnerability in HTTP::Daemon for Perl, advises updating the component, and cites the CVE with CVSS score.