Skip to content
OpenAdvisories
High ELSA-2026-30858 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 8)

Published Jun 29, 2026 · Updated Jun 29, 2026

Ecosystem: Oracle Linux

Summary

[2.081-2]
- Remove use of eval in File::GlobMapper for safer string interpolation
- Resolves: RHEL-180411

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 perl-IO-Compress 0:2.081-2.el8_10

Vulnerabilities 1

  • High 7.3
    CVE-2026-48962 Public exploit

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() …

    PMQS IO::Compress perl perl Debian Ubuntu Azure Linux Alpine