P4 (Helix Core) vulnerabilities
6 known vulnerabilities in P4 (Helix Core) from Perforce. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.5 High severity
P4 (Helix core): Insufficient Granularity of Access Control
P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.
- 7.3 High severity
P4 (Helix core): Relative Path Traversal
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could
- 9.5 Critical severity
P4 (Helix Core): Not Failing Securely
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4
- 7.5 High severity
P4 (Helix Core): External Control of File Name or Path
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 S
- 9.5 Critical severity
P4 (Helix Core): Active Debug Code
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connec
- 7.7 High severity
P4 (Helix Core): Improper Control of Generation of Code
A Remote Code Execution vulnerability in P4 (Helix Core) Server's Command-Line Client, prior to the 2025.2 Patch 2, has been fixed to address potential security risks.