IO::Compress vulnerabilities

2 known vulnerabilities in IO::Compress from PMQS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  IO::Compress: Improper Neutralization of Directives in Dynamically Evaluated Code

  CVE-2026-48962May 27, 2026PMQS

  IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() t

• 7.3 High severity

  IO::Compress: Improper Handling of Exceptional Conditions

  CVE-2026-48961May 27, 2026PMQS

  IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) w