Every CVE Search/ Get API key

CVE-2026-15392

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

7.7 HighFix available

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.20%Unchanged since Jul 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Record
CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
EUVDEUVD-2026-43727 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Record
EUVD-2026-43727
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
NVD 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Record
CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
OSVALPINE-CVE-2026-15392 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Record
ALPINE-CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-15392 7.7
Record
BELL-CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSV 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Record
CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-22, CWE-59
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-15392 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

Record
DEBIAN-CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-15392 7.7

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

Record
UBUNTU-CVE-2026-15392
CVSS 3.1
7.7 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVAZL-92424 No score

CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.

The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.

Callers of file-based drivers can read or write files outside of the data directory.

Record
AZL-92424
Updated
2026-11-02
OSVMGASA-2026-0308 No score

Updated perl-DBI packages fix security vulnerabilities

The updated packages fix several security issues.

Record
MGASA-2026-0308
Updated
2026-11-02
OSVopenSUSE-SU-2026:11298-1 No score

perl-DBI-1.651.0-1.1 on GA media

These are all security issues fixed in the perl-DBI-1.651.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11298-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21412-1 No score

Security update for perl-DBI

This update for perl-DBI fixes the following issues:

  • CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director (bsc#1271629).
  • CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation, which allows for bypass of file-backed filters (bsc#1271399).
  • CVE-2026-60081: DBI:ProfileData does not limit the path index in profile parser, which enables small-file memory-amplification DoS (bsc#1271458).
  • CVE-2026-60082: out-of-bounds access in _set_fbav when a statement handle has zero fields but a non-empty row, which allows for a process crash (bsc#1271459).
Record
openSUSE-SU-2026:21412-1
Updated
2026-11-02
OSVSUSE-SU-2026:22845-1 No score

Security update for perl-DBI

This update for perl-DBI fixes the following issues:

  • CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director (bsc#1271629).
  • CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation, which allows for bypass of file-backed filters (bsc#1271399).
  • CVE-2026-60081: DBI:ProfileData does not limit the path index in profile parser, which enables small-file memory-amplification DoS (bsc#1271458).
  • CVE-2026-60082: out-of-bounds access in _set_fbav when a statement handle has zero fields but a non-empty row, which allows for a process crash (bsc#1271459).
Record
SUSE-SU-2026:22845-1
Updated
2026-11-02
OSVSUSE-SU-2026:22926-1 No score

Security update for perl-DBI

This update for perl-DBI fixes the following issues:

  • CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director (bsc#1271629).
  • CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation, which allows for bypass of file-backed filters (bsc#1271399).
  • CVE-2026-60081: DBI:ProfileData does not limit the path index in profile parser, which enables small-file memory-amplification DoS (bsc#1271458).
  • CVE-2026-60082: out-of-bounds access in _set_fbav when a statement handle has zero fields but a non-empty row, which allows for a process crash (bsc#1271459).
Record
SUSE-SU-2026:22926-1
Updated
2026-11-02
OSVSUSE-SU-2026:3283-1 No score

Security update for perl-DBI

This update for perl-DBI fixes the following issues

  • CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution (bsc#1271018).
  • CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash (bsc#1271017).
  • CVE-2026-15043: incorrect predicate evaluation in DBI:SQL:Nano can lead to bypass of file-backed filters (bsc#1271399).
  • CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in DBD::File allows for arbitrary file reads and writes (bsc#1271629).
  • CVE-2026-60081: no limiting of the path index in profile parser of DBI:ProfileData can enable small-file memory-amplification DoS (bsc#1271458).
  • CVE-2026-60082: out-of-bounds access in _set_fbav when a statement handle has zero fields but a non-empty row can lead to a process crash (bsc#1271459).
Record
SUSE-SU-2026:3283-1
Updated
2026-11-02
OSVSUSE-SU-2026:3415-1 No score

Security update for perl-DBI

This update for perl-DBI fixes the following issues

  • CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution (bsc#1271018).
  • CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash (bsc#1271017).
  • CVE-2026-15043: incorrect predicate evaluation in DBI:SQL:Nano can lead to bypass of file-backed filters (bsc#1271399).
  • CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in DBD::File allows for arbitrary file reads and writes (bsc#1271629).
  • CVE-2026-60081: no limiting of the path index in profile parser of DBI:ProfileData can enable small-file memory-amplification DoS (bsc#1271458).
  • CVE-2026-60082: out-of-bounds access in _set_fbav when a statement handle has zero fields but a non-empty row can lead to a process crash (bsc#1271459).
Record
SUSE-SU-2026:3415-1
Updated
2026-11-02
OSVSUSE-SU-2026:3461-1 No score

Security update for perl-DBI

This update for perl-DBI fixes the following issues:

  • CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution (bsc#1271018).
  • CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process crash (bsc#1271017).
  • CVE-2026-15043: incorrect predicate evaluation in DBI:SQL:Nano can lead to bypass of file-backed filters (bsc#1271399).
  • CVE-2026-15392: missing checks to ensure the table file is not a symlink to an untrusted location in DBD::File allows for arbitrary file reads and writes (bsc#1271629).
  • CVE-2026-60081: no limiting of the path index in profile parser of DBI:ProfileData can enable small-file memory-amplification DoS (bsc#1271458).
  • CVE-2026-60082: out-of-bounds access in _set_fbav when a statement handle has zero fields but a non-empty row can lead to a process crash (bsc#1271459).

Changes for perl-DBI:

  • missing method dependency in the path-containment guard can cause security check failures and functional regressions when handling table symlinks (bsc#1271822).
Record
SUSE-SU-2026:3461-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
perl-dbi
Alpine:v3.24
 before 1.651-r0
1.651-r0
perl-DBI
Azure Linux:3
 before 1.651-1
1.651-1
perl-dbi
Alpaquita:23
 1.643-r4 up to 1.651-r0
1.651-r0
perl-dbi
Alpaquita:25
 1.647-r0 up to 1.651-r0
1.651-r0
perl-dbi
Alpaquita:stream
 1.643-r3 up to 1.651-r0
1.651-r0
libdbi-perl
Debian:12
 before 1.643-4+deb12u2, plus listed versions
1.643-41.643-4+deb12u1
1.643-4+deb12u2
libdbi-perl
Debian:13
 before 1.652-2~deb13u1, plus listed versions
1.647-11.647-1+deb13u11.648-11.649-11.650-11.651-11.652-1
1.652-2~deb13u1
libdbi-perl
Debian:14
 before 1.651-1, plus listed versions
1.647-11.648-11.649-11.650-1
1.651-1
perl-DBI
Mageia:10
From an advisory covering 9 CVEs
 before 1.651.0-1.mga10
1.651.0-1.mga10
perl-DBI
Mageia:9
From an advisory covering 9 CVEs
 before 1.651.0-1.mga9
1.651.0-1.mga9
Show 26 moreShow less
Affected packages
PackageAffectedFixed
perl-DBI
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 1.647.0-160000.5.1
1.647.0-160000.5.1
perl-DBI
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 1.647.0-160000.5.1
1.647.0-160000.5.1
perl-DBI
SUSE:Linux Micro 6.2
From an advisory covering 4 CVEs
 before 1.647.0-160000.5.1
1.647.0-160000.5.1
perl-DBI
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 1.642-150200.3.19.1
1.642-150200.3.19.1
perl-DBI
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 1.647.0-150600.12.18.1
1.647.0-150600.12.18.1
perl-DBI
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 1.647.0-150600.12.18.1
1.647.0-150600.12.18.1
perl-DBI
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 1.647.0-150600.12.18.1
1.647.0-150600.12.18.1
perl-DBI
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.628-5.21.1
1.628-5.21.1
perl-DBI
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 6 CVEs
 before 1.628-5.21.1
1.628-5.21.1
libdbi-perl
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.627-11.628-11.630-11.630-1ubuntu0.1~esm11.630-1ubuntu0.1~esm4
Show 4 moreShow less
1.630-1ubuntu0.1~esm51.630-1ubuntu0.1~esm61.630-1ubuntu0.1~esm81.630-1ubuntu0.1~esm9
 None known
libdbi-perl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.633-11.634-11.634-1build11.634-1ubuntu0.11.634-1ubuntu0.2
Show 4 moreShow less
1.634-1ubuntu0.2+esm11.634-1ubuntu0.2+esm21.634-1ubuntu0.2+esm41.634-1ubuntu0.2+esm5
 None known
libdbi-perl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.637-11.639-11.640-11.640-1ubuntu0.11.640-1ubuntu0.2
Show 4 moreShow less
1.640-1ubuntu0.31.640-1ubuntu0.3+esm11.640-1ubuntu0.3+esm31.640-1ubuntu0.3+esm4
 None known
libdbi-perl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.642-11.642-1build11.643-11.643-1ubuntu0.11.643-1ubuntu0.1+esm11.643-1ubuntu0.1+esm31.643-1ubuntu0.1+esm4
 None known
libdbi-perl
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.643-3build21.643-3build31.643-3ubuntu0.11.643-3ubuntu0.31.643-3ubuntu0.4
 None known
libdbi-perl
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.643-41.643-4build11.643-4build21.643-4build31.643-4ubuntu0.11.643-4ubuntu0.31.643-4ubuntu0.4
 None known
libdbi-perl
Ubuntu:26.10
 All versions, plus listed versions
1.647-1build11.648-11.651-11.652-2
 None known
libdbi-perl
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.647-11.647-1build11.647-1ubuntu0.26.04.11.647-1ubuntu0.26.04.31.647-1ubuntu0.26.04.4
 None known
perl-DBI
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.651.0-1.1
1.651.0-1.1
perl-DBI
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 1.647.0-160000.5.1
1.647.0-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-15392 is a high vulnerability (CVSS 7.7) in Hmbrand Dbd::file, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in perl-dbi 1.651-r0.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open