OALDERS HTTP::Daemon up to 6.16 on Perl send_file os command injection

Summaryinfo

A vulnerability was found in OALDERS HTTP::Daemon up to 6.16 on Perl and classified as critical. This impacts the function send_file. The manipulation results in os command injection. This vulnerability is known as CVE-2026-8450. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in OALDERS HTTP::Daemon up to 6.16 on Perl. Affected is the function send_file. The manipulation with an unknown input leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-8450 since 05/12/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability scanner Nessus provides a plugin with the ID 321644 (SUSE SLES12 Security Update : perl-HTTP-Daemon (SUSE-SU-2026:2408-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.17 eliminates this vulnerability. Applying the patch 945d35141d94490f749640bd4390acd6a2193995 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (321644) and EUVD (EUVD-2026-32050). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• OALDERS

Name

• HTTP::Daemon

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion