CVE-2026-49145

HighCVSS 7.5/10Last modified Jul 8, 2026

Description

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.

ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted.

A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-73 CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2026
Last modified: Jul 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-491467.5App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the di CVE-2026-491477.5App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prin CVE-2026-49156.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to filter nil elements from outgoing webh CVE-2026-491578.8Incorrect Default Permissions vulnerability in Apache ActiveMQ. This issue affects Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.CVE-2026-491587.5Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Th CVE-2026-491596.5Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a n CVE-2026-49162.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 CVE-2026-491607.5Uncontrolled resource consumption in HTTP/2 allows an unauthorized attacker to deny service over a network.CVE-2026-491617.8Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.CVE-2026-491627.0Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-491638.8Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacke CVE-2026-491649.8Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.