CVE-2026-8450

@@ -1,6 +1,18 @@
 Revision history for HTTP-Daemon
 
 {{$NEXT}}
+  - Fix CVE-2026-8450 (affects 6.15 and earlier): 2-arg open() in
+    send_file() enabled RCE / arbitrary file write / response-body
+    exfiltration when a string argument was derived from attacker-
+    influenced input. send_file() now uses 3-arg open() with an
+    explicit '<' read mode, so the path is always treated as a literal
+    filename and 2-arg open() shell-magic shapes ('| cmd', 'cmd |',
+    '> path', etc.) are no longer interpreted. send_file() now also
+    returns '0E0' (true zero) on a successful zero-byte transfer so
+    callers can distinguish empty file from open failure (undef). See
+    https://www.cve.org/CVERecord?id=CVE-2026-8450 for the advisory.
+    Reported and patched by Stig Palmquist (stigtsp). (Stig Palmquist,
+    Olaf Alders)
   - Bump LWP::UserAgent to 6.37 in TestSuggests (GH#65) (Olaf Alders)
 
 6.15      2023-02-22 22:02:46Z

@@ -598,11 +598,10 @@ sub send_dir {
 sub send_file {
     my ($self, $file) = @_;
     my $opened = 0;
-    local (*FILE);
     if (!ref($file)) {
-        open(FILE, $file) || return undef;
-        binmode(FILE);
-        $file = \*FILE;
+        open(my $fh, '<', $file) || return undef;
+        binmode($fh)             || do { close($fh); return undef };
+        $file = $fh;
         $opened++;
     }
     my $cnt = 0;
@@ -614,7 +613,11 @@ sub send_file {
         print $self $buf;
     }
     close($file) if $opened;
-    $cnt;
+
+    # Return a "true zero" for empty-but-successful copies so callers
+    # using `send_file or die` can distinguish open failure (undef)
+    # from a successful zero-byte transfer.
+    $cnt || '0E0';
 }
 
 sub daemon {
@@ -896,6 +899,28 @@ Copy the file to the client.  The file can be a string (which
 will be interpreted as a filename) or a reference to an C<IO::Handle>
 or glob.
 
+Returns the number of bytes copied on success, or C<undef> if the
+filename form failed to open.  An empty file returns the string
+C<'0E0'> (zero numerically, true in boolean context) so that callers
+using C<< send_file or die >> can distinguish open failure from a
+successful zero-byte transfer.
+
+The filename form uses Perl's 3-argument C<open> with an explicit C<<
+< >> mode, so the path is no longer interpreted as a 2-argument
+C<open> shell-magic shape such as C<< | cmd >>, C<< cmd | >>, or
+C<< > path >>.  See
+L<CVE-2026-8450|https://www.cve.org/CVERecord?id=CVE-2026-8450> for
+the prior 2-argument C<open> behaviour this replaces.
+
+Note that this fix only neutralises 2-argument C<open> shell-magic.
+Callers remain responsible for validating attacker-influenced paths:
+C<send_file> will still happily open symlinks, character/block devices
+(e.g. C</dev/zero>, C</dev/stdin>), named pipes (which may block the
+worker), and files outside an intended document root.  If C<$filename>
+can be derived from request input, validate it (canonicalise, reject
+C<..> segments, require C<-f _> and a vetted prefix) before passing it
+in.
+
 =item $c->daemon
 
 Return a reference to the corresponding C<HTTP::Daemon> object.

@@ -45,13 +45,13 @@ my $writer
     = qq{$^X -e 'open my \$f, q{>}, \$ENV{HTTPD_MAGIC_MARKER} or die; close \$f'};
 
 my @magic_shapes = (
-    {name => 'write-pipe', shape => sub {"| $writer"}},
-    {name => 'read-pipe',  shape => sub {"$writer |"}},
 
-    # 2-arg open() strips leading whitespace before checking for magic
-    # prefixes, so " | cmd" (note the leading space) is also a pipe.
-    {name => 'leading-ws-pipe', shape => sub {" | $writer"}},
-    {name => 'write-redirect',  shape => sub { my ($m) = @_; "> $m" }},
+    # One pipe shape stands for the whole command-execution family
+    # (| cmd, cmd |, ...). The leading-space spelling is the one kept:
+    # 2-arg open() strips leading whitespace before testing for a magic
+    # prefix, so " | cmd" also exercises that quirk.
+    {name => 'pipe',           shape => sub {" | $writer"}},
+    {name => 'write-redirect', shape => sub { my ($m) = @_; "> $m" }},
 );
 
 for my $case (@magic_shapes) {