HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file().

send_file() opens its string argument with Perl's 2-arg open(). The 2-ar…

HTTP::Daemon versions before 6.17 for Perl contain an OS command injection vulnerability in the send_file() function. The vulnerability stems from the use of Perl's 2-arg open() which interprets magic prefixes that can execute commands or manipulate files. Attackers can exploit this by passing untrusted input to send_file() to execute OS commands with daemon process privileges. The read-pipe form also leaks subprocess stdout into HTTP responses. Write-mode forms allow creation or truncation of files at attacker-chosen paths.