HTTP::Daemon versions before 6.17 for Perl contain an OS command injection vulnerability in the send_file() function. The vulnerability occurs because send_file() uses Perl's 2-arg open() which interprets magic prefixes that can open pipes to subprocesses or create/modify files. Attackers can exploit this by passing untrusted input to send_file() to execute OS commands with daemon process privileges, leak subprocess output into HTTP responses, or manipulate files at chosen paths. The issue affects all versions prior to 6.17 and has been patched in the latest release.