TI-2026-12952 Aliases CVE-2026-15392

Path traversal in HMBRAND DBD::File

LOW 35CWE-22Published 2026-07-14 · Updated 2026-07-15

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00196 9th percentileScored 2026-11-07

Fix Partial DBD::File (HMBRAND): 1.651Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HMBRAND	DBD::File	before 1.651	1.651	Patch available	CNA

DBD::File VendorHMBRAND Affected before 1.651 Fixed in 1.651 Patch available CNA

Remediation

Fix · CNA DBD::File (HMBRAND) Fixed in 1.651

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-15392

References

TI-2026-12661 DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL… CVSS 3.1CRITICAL 9.8
TI-2026-12417 Out-of-bounds write in HMBRAND DBI CVSS 3.1CRITICAL 9.8
TI-2026-09339 Out-of-bounds write in HMBRAND DBI CVSS 3.1CRITICAL 9.8
TI-2026-08500 Out-of-bounds write in HMBRAND DBI CVSS 3.1CRITICAL 9.8
TI-2026-12418 Out-of-bounds read in HMBRAND DBI CVSS 3.1CRITICAL 9.1
TI-2026-42812 Out-of-bounds read in HMBRAND DBI CVSS 3.1CRITICAL 9.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences