OS command injection is possible in HTTP::Daemon versions before 6.17 when the send_file() function receives untrusted input. The function opens the supplied string with Perl’s 2‑argument open, which interprets magic prefixes that create pipes to a subprocess. As a result, a remote attacker can execute arbitrary operating‑system commands under the uid of the HTTP daemon process, and if the read‑pipe form is used, the subprocess’s stdout is sent back to the HTTP client. The write‑mode forms can also create or truncate files at attacker‑chosen paths, enabling further compromise or persistence.

OALDERS’ HTTP::Daemon module, any installation of HTTP::Daemon 6.16 or earlier, is affected. Upgrading to version 6.17 or later resolves the flaw.

The CVSS score is 9.1 and the EPSS score is < 1%, indicating a high severity and low likelihood of exploitation. The vulnerability’s impact is severe due to its ability to execute arbitrary commands and modify filesystem state. The flaw can be exploited remotely by sending a crafted HTTP request that triggers send_file() with malicious input. Because the flaw is tied to the daemon’s privilege level, running the service as root could lead to a full system compromise. The vulnerability is not yet listed in CISA’s KEV catalog, but the nature of OS command injection warrants immediate attention.