CVE-2026-15392: DBD::File Perl Path Traversal Flaw

CVE-2026-15392 Overview

CVE-2026-15392 is a path traversal vulnerability in DBD::File, a Perl module used as the base class for file-based DBI (Database Interface) drivers such as DBD::CSV and DBD::DBM. Versions before 1.651 do not verify whether a table file is a symbolic link pointing outside the configured data directory. An attacker with local access who can plant a symlink inside the data directory can cause file-based drivers to read or write arbitrary files at any path the calling process can access. The flaw is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Callers of Perl file-based DBI drivers can read or overwrite files outside f_dir and f_dir_search, breaking the data-directory sandbox and enabling privilege escalation when the driver runs under a higher-privileged process.

Affected Products

Perl DBD::File versions before 1.651
File-based DBI drivers built on DBD::File (for example DBD::CSV, DBD::DBM)
Perl applications that expose table names or the data directory to untrusted users

Discovery Timeline

2026-07-14 - CVE CVE-2026-15392 published to NVD
2026-07-14 - Public disclosure via OpenWall oss-security and GitHub Security Advisory GHSA-mh3j-xwf4-jrqw
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15392

Vulnerability Analysis

DBD::File maps SQL table names to files inside directories configured through the f_dir and f_dir_search driver attributes. The complete_table_name method resolves a table name to an absolute file path but never checks whether the resulting path is a symbolic link that escapes those base directories. A symlink placed inside f_dir therefore acts as a redirection primitive: a query referencing the linked table causes the driver to open the symlink target, which can live anywhere on the file system.

Because file-based DBI drivers support both read and write operations, an attacker who controls a table name or the data directory can exfiltrate sensitive files or corrupt files owned by the process. The impact scales with the privileges of the Perl process running the driver, which is why this issue rates high on confidentiality and integrity but not availability.

Root Cause

The root cause is missing symlink validation during path resolution. complete_table_name compared only the resolved search directory against the allow-listed base paths, not the final table file. Symlinks inside an allow-listed directory bypassed the check because their resolved location was never compared against f_dir or f_dir_search.

Attack Vector

Exploitation requires local file-system access to place a symlink inside the driver's data directory, or the ability to influence the table name resolved by a Perl application using DBD::File. No authentication or user interaction with the vulnerable application is required. The attacker gains read or write access to any file reachable by the Perl process.

text

     # Note this triggers only when *used*, not at definition time
     #   $dbh->{csv_tables}{foo}{file} = "/out/side/scope/foo.csv"; # OK
     #   $dbh->do ("create table foo (c char)"); # FAIL
+    my @bases = map { Cwd::abs_path ($_) } $meta->{f_dir}, @{$meta->{f_dir_search} || []};
     if ($searchdir) {
         my $sd = Cwd::abs_path ($searchdir);
-        my @sd = map { Cwd::abs_path ($_) } $meta->{f_dir}, @{$meta->{f_dir_search} || []};
-	unless (List::Util::first { $_ eq $sd } @sd) {
+        unless (List::Util::first { $_ eq $sd } @bases) {
 	    croak "Using data files in $searchdir is unsafe and not allowed.\nUse f_dir or f_dir_search.\n";
 	    }
 	}

Source: GitHub patch commit 96d62dfe. The patch precomputes the resolved base directories and enforces the check against the canonicalized path so a symlink target outside f_dir or f_dir_search is rejected.

Detection Methods for CVE-2026-15392

Indicators of Compromise

Symbolic links inside directories configured as f_dir or f_dir_search for any Perl DBD::File-based driver.
Unexpected file access by Perl processes to paths outside the intended data directory, especially to sensitive files such as /etc/passwd, SSH keys, or application configuration files.
Write access or modification timestamps changed on files outside the data directory correlated with Perl DBI activity.

Detection Strategies

Inventory installed Perl modules and flag hosts where DBI reports DBD::File older than 1.651 (perl -MDBD::File -e 'print $DBD::File::VERSION').
Audit file-based DBI configurations for the f_dir and f_dir_search values and scan those directories for symlinks whose targets fall outside the allow list.
Enable process-level file access telemetry on servers running Perl workloads and alert on open() calls from perl processes that traverse out of expected working directories.

Monitoring Recommendations

Collect and centralize file-system audit events (auditd, EDR telemetry) for perl processes writing outside their working directory.
Monitor code repositories and build pipelines for pinned DBD::File or DBI versions below 1.651 and fail builds that regress the dependency.
Alert on creation of symlinks by low-privileged users inside directories owned or used by higher-privileged Perl services.

How to Mitigate CVE-2026-15392

Immediate Actions Required

Upgrade DBI to version 1.651 or later on every system that has DBD::File or a derived driver installed.
Enumerate all Perl applications using DBD::CSV, DBD::DBM, or other DBD::File subclasses and schedule redeployment against the patched module.
Remove any symbolic links currently residing in f_dir or f_dir_search directories and restrict write access to those directories to trusted accounts only.

Patch Information

The fix is included in DBI 1.651 on CPAN. Details are documented in the MetaCPAN DBI-1.651 changelog and the upstream GitHub patch commit 96d62dfe. The patch canonicalizes the resolved file path and confirms it falls inside an allow-listed base directory before opening the table file.

Workarounds

Run Perl services that use DBD::File under a dedicated, low-privileged account so that any file access via a malicious symlink is bounded by that account's permissions.
Enforce strict directory permissions (chmod 700) on f_dir and f_dir_search so untrusted users cannot create symlinks inside them.
Where feasible, mount the data directory with the nosymfollow option (Linux nosymfollow mount flag) to block symlink traversal at the kernel level.

bash

# Configuration example: upgrade DBI and lock down the data directory
cpanm DBI@1.651
perl -MDBI -e 'print $DBI::VERSION, "\n"'

# Restrict the DBD::File data directory
chown appuser:appuser /var/lib/dbdfile
chmod 700 /var/lib/dbdfile
find /var/lib/dbdfile -type l -print -delete