App::Ack, a Perl search tool that loads project configuration from a .ackrc file in the current directory tree, allows the --files-from option to be specified in that configuration. Because the configuration blocklist does not exclude this option, an attacker can place a malicious .ackrc that points to any file the user can read. The tool will then read and expose the contents or matched lines of that file, enabling arbitrary file read on the system. The defect is captured in CVSS score 7.5, indicating high severity.

Vulnerability affects the PETDANCE platform product App::Ack up to version 3.10.0. The patch release after 3.10.0 adds the --follow parameter to the blocklist, but --files-from remains accepted, so an update that blocks this option is required for protection.

The EPSS score is below 1%, showing a very low documented probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, and no known public exploits exist. The likely attack vector is local execution of ack with a malicious .ackrc, wherein an attacker must influence the working directory or supply a repository that contains a malicious .ackrc. Remote exploitation would need an additional vector to get the target to run ack in a compromised configuration. Overall risk remains moderate, yet the high severity warrants timely remediation.