IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.

_parseOutputGlob() wraps the…

CVE-2026-48962 affects IO::Compress versions before 2.220 for Perl, allowing arbitrary code execution through File::GlobMapper via attacker-controlled output glob. The vulnerability exists in _parseOutputGlob() function which wraps caller-supplied output glob string in double quotes and stores it in parser state. The _getFiles() function then runs the stored expression through eval STRING. An attacker can inject a literal double quote in the output glob to close the dquote wrapper, causing following characters to be evaluated as Perl code. The arbitrary Perl code executes with the calling process's privileges, making this a high-severity vulnerability.