CVE-2026-49145 Details
Description
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.
A vulnerability in App::Ack, affecting versions through 3.10.0, allows for arbitrary file reading and potential exfiltration. This issue arises from the '--files-from' option being used in a project-specific .ackrc file. The application searches for a project .ackrc file in the directory hierarchy and loads its configurations. The default blocklist for project-source options in App::Ack::ConfigLoader does not include '--files-from', enabling the specification of a file path that ack will read from and search. Although version 3.10.0 added '--follow' to the blocklist, '--files-from' remains unblocked. Consequently, a .ackrc file in an untrusted repository can be exploited to read files outside the project directory and output their contents if they match the search criteria.
Users can update to App::Ack version 3.10.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/PETDANCE/ack-v3.10.0/source/Changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/07/08/7 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-426 | Untrusted Search Path | CPANSec |
| CWE-73 | External Control of File Name or Path | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| App::Ack | <= 3.10.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CVE |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | CPANSec |