CVE-2026-8450

A flaw was found in HTTP::Daemon, a Perl module used for creating HTTP servers. A remote attacker can exploit this vulnerability by providing specially crafted input to the send_file() function, leading to OS command injection. This allows the attacker to execute arbitrary commands on the system with the privileges of the daemon process, potentially resulting in full system compromise or data manipulation.

This is rated as an Important security flaw becaye the function utilizes an insecure 2-argument open() call that interprets shell-magic characters (such as pipes or redirects) inside file paths. In a non-default configuration where a custom application passes untrusted user input directly to this function, a remote attacker could exploit this flaw to read or write arbitrary files, or potentially execute commands within the context of the daemon's local system user.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.