Detections
Analytics

Echo: perl: security update to 5.40.1-6+e18

high Tenable Cloud Security Plugin ID 455441

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an
 attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double
 quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING.
 A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are
 evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
 (CVE-2026-48962)

Solution

Update the perl library and its related packages to version 5.40.1-6+e18 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-48962

Plugin Details

Severity: High

ID: 455441

Version: Revision 1.1

Type: Local

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.92

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-48962

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/27/2026

Vulnerability Publication Date: 5/27/2026

Reference Information

CVE: CVE-2026-48962