The vulnerability resides in DBD::File, a Perl driver that constructs absolute paths for table files without checking for symbolic links, a flaw classified as CWE-22 (Path Traversal) and CWE-59 (Improper Handling of Symlink). If a symlink within the data directory points to a location outside the configured f_dir or f_dir_search directories, an attacker can read or write arbitrary files on the filesystem. This flaw permits the alteration or exfiltration of data typically confined to the application’s data directory, potentially exposing sensitive information or corrupting critical system files.

The affected product is HMBRAND DBD::File for Perl, versions prior to 1.651. Users running DBD::File 1.650 or earlier are susceptible, while 1.651 and later contain the requisite symlink validation.

The CVSS score of 7.7 indicates a high severity level, yet the EPSS score of less than 1% suggests that exploitation is currently uncommon. This flaw is not listed in the CISA KEV catalog. The likely attack vector requires an adversary with write access to the driver’s data directory; from that position, the attacker can craft a symlink that redirects file operations outside the intended boundaries. If such local access is achieved, the compromise can affect the confidentiality, integrity, and availability of files on the host.