Every CVE Search/ Get API key

CVE-2026-49145

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc

7.5 HighFix available

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.49%Up 0.2 points since Jul 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
CVE-2026-49145
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-73, CWE-426
Updated
2026-11-02
EUVDEUVD-2026-42288 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
EUVD-2026-42288
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-c2rv-g977-2fxr 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project ...

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
GHSA-c2rv-g977-2fxr
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-73
Updated
2026-11-02
NVD 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
CVE-2026-49145
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-73, CWE-426
Updated
2026-11-02
OSVALPINE-CVE-2026-49145 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
ALPINE-CVE-2026-49145
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
CVE-2026-49145
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-426, CWE-73
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2026-49145 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
DEBIAN-CVE-2026-49145
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-49145 7.5

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Record
UBUNTU-CVE-2026-49145
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2026-0239 No score

Updated ack packages fix security vulnerabilities

This update fixes several security vulnerabilities.

Record
MGASA-2026-0239
Updated
2026-11-02
OSVopenSUSE-SU-2026:10965-1 No score

ack-3.10.0-1.1 on GA media

These are all security issues fixed in the ack-3.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10965-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ack
Alpine:v3.24
 before 3.10.0-r0
3.10.0-r0
ack
Debian:12
 All versions, plus listed versions
3.6.0-13.7.0-13.8.1-1
 None known
ack
Debian:13
 All versions, plus listed versions
3.8.1-1
 None known
ack
Debian:14
 All versions, plus listed versions
3.8.1-1
 None known
ack
Mageia:10
From an advisory covering 3 CVEs
 before 3.10.0-1.mga10
3.10.0-1.mga10
ack
Mageia:9
From an advisory covering 3 CVEs
 before 3.10.0-1.mga9
3.10.0-1.mga9
ack
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.22-1
 None known
ack
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.2-13.1.3-13.2.0-13.3.1-1
 None known
ack
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.4.0-13.5.0-1
 None known
ack
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.7.0-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
ack
Ubuntu:25.10
 All versions, plus listed versions
3.7.0-13.8.1-1
 None known
ack
Ubuntu:26.10
 All versions, plus listed versions
3.8.1-1
 None known
ack
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.8.1-1
 None known
ack
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 3.10.0-1.1
3.10.0-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-49145 is a high vulnerability (CVSS 7.5) in Petdance App::ack, published June 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in ack 3.10.0-r0.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open