Skip to content
OpenAdvisories

Product · Perforce

P4 (Helix Core)

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.1
    CVE-2026-103511

    Arbitrary file-write via extension installation in P4Search

    Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.

    Perforce P4 (Helix Core)
  • Medium 5.3
    CVE-2026-103512

    Ticket host-binding bypass via spoofed client IP in P4Search

    Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 S…

    Perforce P4 (Helix Core)