IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the…

CVE-2026-48962 affects IO::Compress versions before 2.220 for Perl, allowing arbitrary code execution through File::GlobMapper via attacker-controlled output glob. The vulnerability occurs when _parseOutputGlob() wraps caller-supplied output glob strings in double quotes and stores them in parser state. The _getFiles() function then executes the stored expression through eval STRING. An attacker can inject a literal double quote in the output glob to close the wrapper and execute arbitrary Perl code. The malicious code executes with the privileges of the calling process, making this a critical security issue.