CVE-2026-49145

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.

• CWE-73
• CWE-426

• https://metacpan.org/release/PETDANCE/ack-v3.10.0/source/Changes
• http://www.openwall.com/lists/oss-security/2026/07/08/7

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49139Nanobot prior to version 0.2.1 contains a server-side reques…7
• CVE-2026-4914Stored XSS in Ivanti N-ITSM before version 2025.4 allows a r…5.4
• CVE-2026-49140Nanobot prior to version 0.2.1 contains a denial of service …5.3
• CVE-2026-49141WACRM prior to commit 73041bf contain an authorization bypas…7.1
• CVE-2026-49143BrowserStack Runner through 0.9.5 contains a remote code exe…8.8
• CVE-2026-49144BrowserStack Runner through 0.9.5 contains a path traversal …7.1
• CVE-2026-49146App::Ack versions before 3.10.0 for Perl allow memory exhaus…7.5
• CVE-2026-49147App::Ack versions through 3.10.0 for Perl print unsanitised …7.5
• CVE-2026-4915Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4…6.5
• CVE-2026-49157Incorrect Default Permissions vulnerability in Apache Active…8.8
• CVE-2026-49158Improper Handling of Highly Compressed Data (Data Amplificat…7.5
• CVE-2026-49159Exposure of sensitive information to an unauthorized actor i…6.5