send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append.
Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| OALDERS | HTTP::Daemon | unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to HTTP-Daemon 6.17 or later.
Workaround
No workaround given by the vendor.
Wed, 27 May 2026 05:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths. | |
| Title | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file() | |
| Weaknesses | CWE-73 CWE-78 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-05-27T07:24:59.662Z
Reserved: 2026-05-12T21:26:04.212Z
Link: CVE-2026-8450
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-27T05:16:23.067
Modified: 2026-05-27T05:16:23.067
Link: CVE-2026-8450
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-05-27T06:30:06Z