HTTP::Daemon vulnerabilities

1 known vulnerability in HTTP::Daemon from Oalders. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  HTTP::Daemon: External Control of File Name or Path

  CVE-2026-8450May 27, 2026OaldersEPSS 1.4%

  HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> p