CVE-2011-10007 Details
Description
File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)
A vulnerability allowing arbitrary code execution exists in the File::Find::Rule Perl module, affecting versions through 0.34. The issue arises when the 'grep()' function processes a specially crafted filename. This vulnerability is caused by the two-argument form of the 'open()' function, which allows an attacker to manipulate the filename to execute arbitrary commands. Exploitation can be demonstrated by creating a file with a name that includes a command, such as 'id', and then using 'File::Find::Rule' to grep for a pattern that triggers the file handling.
Users are advised to update to version 0.35 or later, where this vulnerability has been fixed. Instructions for updating can be found in the Debian LTS advisory DLA-4209-1.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 5, 2025CISA-ADP
Assessed Jun 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/richardc/perl-file-find-rule/pull/4 | CISA-ADP | ExploitIssue TrackingRemedyVendor |
| https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch | CPANSec | Source CodeVendor |
| https://github.com/richardc/perl-file-find-rule/pull/4 | CPANSec | ExploitIssue TrackingRemedyVendor |
| https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423 | CPANSec | Source Code |
| https://rt.cpan.org/Public/Bug/Display.html?id=64504 | CPANSec | ExploitIssue TrackingTechnical DescriptionVendor |
| https://lists.debian.org/debian-lts-announce/2025/06/msg00006.html | CVE | AdvisoryMailing ListRemedy |
| http://www.openwall.com/lists/oss-security/2025/06/05/4 | CVE | AdvisoryMailing ListRemedy |
| http://www.openwall.com/lists/oss-security/2025/06/06/1 | CVE | Mailing List |
| http://www.openwall.com/lists/oss-security/2025/06/06/3 | CVE | Mailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| RCLAMP File::Find::Rule | All versions |
CPE
Remediation
| |
| Debian | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 16, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | CVE Modified | CPANSec |
| Jun 6, 2025 | CVE Modified | CVE |
| Jun 5, 2025 | CVE Modified | CVE |
| Jun 5, 2025 | CVE Modified | CVE |
| Jun 5, 2025 | CVE Modified | CISA-ADP |
| Jun 5, 2025 | New CVE Received | CPANSec |