VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 5, 2025· Updated Apr 15, 2026

CVE-2011-10007

CVE-2011-10007

Description

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep() encounters a crafted filename.

A file handle is opened with the 2 argument form of open() allowing an attacker controlled filename to provide the MODE parameter to open(), turning the filename into a command to be executed.

Example:

$ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

Affected products

1

Patches

2
df58128bcee4

Fix for CVE-2011-10007: Use 3 arg open in grep()`

https://github.com/richardc/perl-file-find-ruleStig PalmquistJun 5, 2025via osv
commit
1 file changed · +1 −1
  • lib/File/Find/Rule.pm+1 −1 modified
    @@ -420,7 +420,7 @@ sub grep {
 
     $self->exec( sub {
         local *FILE;
-        open FILE, $_ or return;
+        open FILE, '<', $_ or return;
         local ($_, $.);
         while (<FILE>) {
             for my $p (@pattern) {
8ee2b3d13e08

Merge pull request #4 from stigtsp/CVE-2011-10007

https://github.com/richardc/perl-file-find-ruleRichard ClampJun 5, 2025via osv
commitPR #4
1 file changed · +1 −1
  • lib/File/Find/Rule.pm+1 −1 modified
    @@ -420,7 +420,7 @@ sub grep {
 
     $self->exec( sub {
         local *FILE;
-        open FILE, $_ or return;
+        open FILE, '<', $_ or return;
         local ($_, $.);
         while (<FILE>) {
             for my $p (@pattern) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.