Skip to content
OpenAdvisories
High ELSA-2026-30859 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 9)

Published Jun 29, 2026 · Updated Jun 29, 2026

Ecosystem: Oracle Linux

Summary

[2.102-4.1]
- Fix CVE-2026-48962: remove use of eval in File::GlobMapper
- Resolves: RHEL-180418

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 9 perl-IO-Compress 0:2.102-4.el9_8.1

Vulnerabilities 1

  • High 7.3
    CVE-2026-48962 Public exploit

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() …

    PMQS IO::Compress perl perl Debian Ubuntu Azure Linux Alpine