Config::IniFiles pre‑version 3.001000 opens the -file argument using Perl’s 2‑argument open, which interprets filenames that begin or end with a pipe or redirect characters as shell commands or redirections. This flaw allows an attacker who can influence the -file parameter to inject arbitrary operating‑system commands or to overwrite files by redirecting output to a target path. The vulnerability is formally mapped to CWE‑73 (OS Command Injection) and CWE‑78 (Improper Neutralization of Special Elements used in a Command).

The affected product is the Perl module SHLOMIF::Config::IniFiles, versions prior to 3.001000. Any system that loads or parses INI files with this module and supplies untrusted data to the -file option is at risk. The issue is specific to the module’s internal _make_filehandle routine and does not affect other Perl modules or native binaries.

The CVSS score is not provided in the CVE data, but the exploitability is clear: an attacker can supply a specially crafted filename and have the target process execute arbitrary commands or truncate arbitrary files under the process UID. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the configuration parsing path where an untrusted user can supply or influence the -file argument. There are no known mitigations beyond those provided by the vendor, so the risk remains high until fixed.