CVE-2026-8450
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
CVE-2026-8450- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-73, CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-32050
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
EUVD-2026-32050- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3hc6-3p33-wq57
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file...
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
GHSA-3hc6-3p33-wq57- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-73, CWE-78
- Updated
- 2026-11-02
NVD
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
CVE-2026-8450- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-73, CWE-78
- Updated
- 2026-11-02
OSV
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
CVE-2026-8450- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-73, CWE-78
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-8450
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
DEBIAN-CVE-2026-8450- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 18 moreShow less
OSVRHSA-2026:36187
Red Hat Security Advisory: perl-HTTP-Daemon security update
- Record
RHSA-2026:36187- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:36188
Red Hat Security Advisory: perl-HTTP-Daemon security update
- Record
RHSA-2026:36188- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:36189
Red Hat Security Advisory: perl-HTTP-Daemon security update
- Record
RHSA-2026:36189- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:36187
Important: perl-HTTP-Daemon security update
The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.
Security Fix(es):
- perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:36187- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:36188
Important: perl-HTTP-Daemon security update
The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.
Security Fix(es):
- perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:36188- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:36189
Important: perl-HTTP-Daemon security update
The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.
Security Fix(es):
- perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:36189- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-8450
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
UBUNTU-CVE-2026-8450- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2026:36187 No score
Important: perl-HTTP-Daemon security update
The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.
Security Fix(es):
- perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:36187- Updated
- 2026-11-02
OSVALSA-2026:36188 No score
Important: perl-HTTP-Daemon security update
The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.
Security Fix(es):
- perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:36188- Updated
- 2026-11-02
OSVALSA-2026:36189 No score
Important: perl-HTTP-Daemon security update
The perl-HTTP-Daemon package includes the HTTP::Daemon class, a subclass of IO::Socket::IP. Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a socket for incoming requests.
Security Fix(es):
- perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:36189- Updated
- 2026-11-02
OSVAZL-93024 No score
CVE-2026-8450 affecting package perl-HTTP-Daemon for versions less than 6.16-2
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().
send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
- Record
AZL-93024- Updated
- 2026-11-05
OSVMGASA-2026-0157 No score
Updated perl-HTTP-Daemon package fixes a security vulnerability
The updated package fixes a security vulnerability: HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). (CVE-2026-8450)
- Record
MGASA-2026-0157- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10938-1 No score
perl-HTTP-Daemon-6.170.0-1.1 on GA media
These are all security issues fixed in the perl-HTTP-Daemon-6.170.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10938-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21119-1 No score
Security update for perl-HTTP-Daemon
This update for perl-HTTP-Daemon fixes the following issue
- CVE-2026-8450: HTTP: Daemon versions before 6.17 for Perl allow OS command injection via send_file() (bsc#1266370).
- Record
openSUSE-SU-2026:21119-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22187-1 No score
Security update for perl-HTTP-Daemon
This update for perl-HTTP-Daemon fixes the following issue
- CVE-2026-8450: HTTP: Daemon versions before 6.17 for Perl allow OS command injection via send_file() (bsc#1266370).
- Record
SUSE-SU-2026:22187-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2408-1 No score
Security update for perl-HTTP-Daemon
This update for perl-HTTP-Daemon fixes the following issues:
- CVE-2026-8450: Fixed OS command injection via send_file() (bsc#1266370).
- Record
SUSE-SU-2026:2408-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2442-1 No score
Security update for perl-HTTP-Daemon
This update for perl-HTTP-Daemon fixes the following issues:
- CVE-2026-8450: Fixed OS command injection via send_file() (bsc#1266370).
- Record
SUSE-SU-2026:2442-1- Updated
- 2026-11-02
OSVUSN-8419-1 No score
libhttp-daemon-perl vulnerability
It was discovered that HTTP-Daemon incorrectly handled untrusted input under certain circumstances. A remote attacker could possibly use this issue to execute arbitrary commands, create or overwrite arbitrary files, or expose sensitive information.
- Record
USN-8419-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-HTTP-DaemonAlmaLinux:9 |
before 6.12-6.el9_8.1 | 6.12-6.el9_8.1 |
perl-HTTP-DaemonAlmaLinux:8 |
before 6.01-24.el8_10 | 6.01-24.el8_10 |
perl-HTTP-DaemonAlmaLinux:10 |
before 6.16-7.el10_2.1 | 6.16-7.el10_2.1 |
perl-HTTP-DaemonAzure Linux:3 |
before 6.16-2 | 6.16-2 |
libhttp-daemon-perlDebian:12 |
before 6.16-1+deb13u1~deb12u1, plus listed versions 6.16-1 |
6.16-1+deb13u1~deb12u1 |
libhttp-daemon-perlDebian:13 |
before 6.16-1+deb13u1, plus listed versions 6.16-16.16-1+deb13u1~deb12u1 |
6.16-1+deb13u1 |
libhttp-daemon-perlDebian:14 |
before 6.17-1, plus listed versions 6.16-1 |
6.17-1 |
perl-HTTP-DaemonMageia:9 |
before 6.140.0-3.1.mga9 | 6.140.0-3.1.mga9 |
perl-HTTP-DaemonRed Hat:enterprise_linux:9::crb |
before 0:6.12-6.el9_8.1 | 0:6.12-6.el9_8.1 |
perl-HTTP-DaemonRed Hat:enterprise_linux:8::crb |
before 0:6.01-24.el8_10 | 0:6.01-24.el8_10 |
Show 29 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-HTTP-DaemonRed Hat:enterprise_linux:10.2 |
before 0:6.16-7.el10_2.1 | 0:6.16-7.el10_2.1 |
perl-HTTP-DaemonRocky Linux:9 |
before 0:6.12-6.el9_8.1 | 0:6.12-6.el9_8.1 |
perl-HTTP-DaemonRocky Linux:8 |
before 0:6.01-24.el8_10 | 0:6.01-24.el8_10 |
perl-HTTP-DaemonRocky Linux:10 |
before 0:6.16-7.el10_2.1 | 0:6.16-7.el10_2.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server 16.0 |
before 6.16-160000.3.1 | 6.16-160000.3.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 6.16-160000.3.1 | 6.16-160000.3.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server 12 SP5-LTSS |
before 6.01-9.8.1 | 6.01-9.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 |
before 6.01-9.8.1 | 6.01-9.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Module for Basesystem 15 SP7 |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
perl-HTTP-DaemonSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 6.01-150000.3.8.1 | 6.01-150000.3.8.1 |
libhttp-daemon-perlUbuntu:Pro:14.04:LTS |
before 6.01-1ubuntu0.14.04~esm2, plus listed versions 6.01-16.01-1ubuntu0.14.04~esm1 |
6.01-1ubuntu0.14.04~esm2 |
libhttp-daemon-perlUbuntu:Pro:16.04:LTS |
before 6.01-1ubuntu0.16.04~esm2, plus listed versions 6.01-16.01-1ubuntu0.16.04~esm1 |
6.01-1ubuntu0.16.04~esm2 |
libhttp-daemon-perlUbuntu:Pro:18.04:LTS |
before 6.01-1ubuntu0.1+esm1, plus listed versions 6.01-16.01-1ubuntu0.1 |
6.01-1ubuntu0.1+esm1 |
libhttp-daemon-perlUbuntu:Pro:20.04:LTS |
before 6.06-1ubuntu0.1+esm1, plus listed versions 6.04-16.06-16.06-1ubuntu0.1 |
6.06-1ubuntu0.1+esm1 |
libhttp-daemon-perlUbuntu:22.04:LTS |
before 6.13-1ubuntu0.2, plus listed versions 6.12-16.13-16.13-1ubuntu0.1 |
6.13-1ubuntu0.2 |
libhttp-daemon-perlUbuntu:24.04:LTS |
before 6.16-1ubuntu0.24.04.1, plus listed versions 6.16-1 |
6.16-1ubuntu0.24.04.1 |
libhttp-daemon-perlUbuntu:25.10 |
before 6.16-1ubuntu0.25.10.1, plus listed versions 6.16-1 |
6.16-1ubuntu0.25.10.1 |
libhttp-daemon-perlUbuntu:26.04:LTS |
before 6.16-1ubuntu0.26.04.1, plus listed versions 6.16-1 |
6.16-1ubuntu0.26.04.1 |
perl-HTTP-DaemonopenSUSE:Tumbleweed |
before 6.170.0-1.1 | 6.170.0-1.1 |
perl-HTTP-DaemonopenSUSE:Leap 16.0 |
before 6.16-160000.3.1 | 6.16-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-8450 is a critical vulnerability (CVSS 9.1) in Oalders Http::daemon, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in perl-HTTP-Daemon 6.12-6.el9_8.1.
References
github.com/libwww-perl/HTTP-Daemon/pull/89
metacpan.org/release/OALDERS/HTTP-Daemon-6.17/changes
openwall.com/lists/oss-security/2026/05/27/5
lists.debian.org/debian-lts-announce/2026/06/msg00028.html
access.redhat.com/security/cve/CVE-2026-8450
Show 33 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2481773
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8450.json
nvd.nist.gov/vuln/detail/CVE-2026-8450
errata.almalinux.org/9/ALSA-2026-36187.html
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-8450
advisories.mageia.org/MGASA-2026-0157.html
bugs.mageia.org/show_bug.cgi?id=35594
cve.org/CVERecord?id=CVE-2026-8450
errata.rockylinux.org/RLSA-2026:36187
suse.com/support/update/announcement/2026/suse-su-202622187-1
bugzilla.suse.com/1266370
ubuntu.com/security/CVE-2026-8450
lists.security.metacpan.org/cve-announce/msg/40435207