CVE-2026-15392

A flaw was found in DBD::File. The complete_table_name method, responsible for building absolute table file paths, does not verify if the file is a symbolic link. This oversight allows a local attacker to create a symbolic link within the data directory that points to an arbitrary file outside of the intended data storage. Consequently, file-based drivers can be tricked into reading from or writing to unauthorized files, potentially leading to information disclosure or data corruption.

This Moderate flaw in DBD::File allows a local attacker to achieve arbitrary file read and write access. By creating a symbolic link within the data directory, an attacker can trick file-based drivers into accessing files outside of the intended directories, leading to potential information disclosure or data corruption. This issue is only exploitable by local attackers with write access to the directory used by an application using DBD::File perl module to write or read database data files.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that directories used by applications using DBD::File for data storage have restricted write permissions, preventing untrusted local users from creating symbolic links. This operational control limits an attacker's ability to exploit the vulnerability by preventing the creation of malicious symlinks.