{"id":"AZL-92424","summary":"CVE-2026-15392 affecting package perl-DBI for versions less than 1.651-1","details":"DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location.\n\nThe complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories.\n\nCallers of file-based drivers can read or write files outside of the data directory.","modified":"2026-08-28T17:48:12.600735904Z","published":"2026-07-14T16:16:45Z","upstream":["CVE-2026-15392"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15392"}],"affected":[{"package":{"name":"perl-DBI","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-DBI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.651-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92424.json"}}],"schema_version":"1.9.0"}