CVE-2026-48962 Details

A vulnerability in the IO::Compress Perl module, affecting versions prior to 2.220, allows for arbitrary code execution through the File::GlobMapper component. The issue arises because the output glob parsing function, _parseOutputGlob(), improperly handles user-supplied glob strings by wrapping them in double quotes and storing them for later evaluation. This creates an opportunity for code execution, as a double quote can terminate the string prematurely, allowing subsequent characters to be executed as Perl code. The vulnerability exploits the eval function, which executes Perl code in the context of the calling process, potentially leading to severe consequences if the executed code escalates privileges or manipulates sensitive data.

Users can upgrade to IO::Compress version 2.220 or later, where this vulnerability has been addressed.