CVE-2026-8450: HTTP::Daemon for Perl: OS command injection via send_file()
HTTP::Daemon for Perl versions before 6.17 contain an OS command injection flaw in send_file(), tracked as CVE-2026-8450. Untrusted input can run commands with the daemon's privileges and create or truncate files at attacker-chosen paths. The record lists CVSS 3.1 scores of 9.1 and 8.1, and no confirmed exploitation appears in the sources consulted.
Overview
HTTP::Daemon, a Perl module used to build HTTP servers, has an OS command injection issue in its send_file() method in versions before 6.17. The method opens its string argument with the two-argument form of Perl's open(), which treats certain prefixes as instructions to start a subprocess or to write to a file.
Impact
- Untrusted input passed to send_file() can run operating system commands with the privileges of the daemon process.
- The read-pipe form can expose subprocess output in the HTTP response body.
- The write-mode forms can create or truncate files at paths chosen by an attacker.
The record lists a CVSS 3.1 base score of 9.1 with network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality and integrity impact. A second CVSS 3.1 score of 8.1 comes from a different provider, and its vector is not included in the record.
Affected products and versions
- HTTP::Daemon for Perl, versions before 6.17, according to the record description.
- The record's affected list is empty, so the exact affected packages and distribution builds cannot be determined from the record alone.
- Distribution advisories are referenced, but the package versions they cover are not included in the record.
Exploitation status
The record shows no CISA KEV listing. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.02614 with a percentile of 0.85038. This is a statistical estimate of likelihood, not evidence of attacks.
Remediation and mitigation
- Upgrade HTTP::Daemon to version 6.17 or later, which the description does not list as vulnerable. Confirm the fix against the advisory for your platform.
- If patching is delayed, stop passing untrusted or user-influenced strings to send_file() and limit it to fixed, validated file paths.
- Run the daemon with the least privilege practical and restrict write access to directories it can reach.
- Check the Red Hat CVE page and the Debian LTS announcement for distribution-specific status.
- Review the upstream pull request and the release changes to confirm the scope of the fix.
Detection guidance
- Look for unexpected child processes started by the HTTP daemon process.
- Monitor for new or modified files in document roots, configuration paths or other locations the service can write to.
- Review HTTP responses from file-serving routes for unexpected command output.
- Correlate unusual requests to file-serving endpoints with the events above.
Limitations of the available information
- The record has no structured list of affected or fixed versions and no CPE data.
- Distribution package versions are not provided.
- The record does not identify which application routes call send_file().
- The KEV fields are empty apart from the listing flag, and the CWE name is missing.
- The EPSS date in the record is later than the publication date, and its significance here is unclear.
Frequently asked questions
Which versions are affected?
The record describes HTTP::Daemon for Perl versions before 6.17 as affected. Its affected list is empty, so check your distribution's advisory for exact package versions.
Is this vulnerability being exploited?
The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.
What should I do now?
Upgrade to HTTP::Daemon 6.17 or later where possible. Until patched, avoid passing untrusted input to send_file() and limit it to fixed, validated paths.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.