CVE-2026-8450 Details
Description
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
A command injection vulnerability has been identified in HTTP::Daemon versions prior to 6.17 for Perl. The issue arises in the send_file() function, which uses Perl's two-argument open() method. This method can be manipulated with magic prefixes to execute OS commands or to open files for writing at arbitrary paths. Exploitation of this vulnerability allows for remote code execution or unauthorized file manipulation under the daemon process's user ID. Additionally, the read-pipe form of the command injection leaks the output of the executed command into the HTTP response body.
Users are advised to update to HTTP::Daemon version 6.17 or later, where this vulnerability has been patched. The patch changes the send_file() function to use the three-argument open() method with an explicit read mode, preventing the interpretation of magic prefixes and command injection. The updated version is available on CPAN.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 27, 2026CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:36187 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:36188 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:36189 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-8450 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2481773 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8450.json | redhat-SADP | |
| https://github.com/libwww-perl/HTTP-Daemon/commit/945d35141d94490f749640bd4390acd6a2193995.patch | CPANSec | Source CodeVendor |
| https://github.com/libwww-perl/HTTP-Daemon/pull/89 | CPANSec | Issue TrackingVendor |
| https://metacpan.org/release/OALDERS/HTTP-Daemon-6.17/changes | CPANSec | Release NotesVendor |
| https://lists.debian.org/debian-lts-announce/2026/06/msg00028.html | CVE | |
| http://www.openwall.com/lists/oss-security/2026/05/27/5 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | CPANSec |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | redhat-SADP |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| HTTP::Daemon | < 6.17 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 7, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 22, 2026 | CVE Modified | CVE |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CVE |
| May 27, 2026 | New CVE Received | CPANSec |