CVE-2026-49145
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedApp::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Version 3.10.0 added --follow to the blocklist; --files-from remains accepted. A project .ackrc committed to an untrusted repository can make ack read files outside the project and print their matching lines.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceApp::Ack versions through 3.10.0 for Perl suffer from an uncontrolled search path vulnerability. The tool searches for and loads project .ackrc files from parent directories, and the option blocklist does not include --files-from. An attacker can craft a malicious .ackrc containing --files-from pointing to sensitive files outside the project (e.g., /etc/passwd), causing ack to read and display matching content when executed in that directory.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Check installed App::Ack versionRun 'ack --version' or 'perl -MApp::Ack -e 'print $App::Ack::VERSION'' to determine the versionAffected if Version is 3.10.0 or lower (any version through 3.10.0)
-
Locate project .ackrc filesCheck for .ackrc files in the current directory and walk up parent directories using commands like 'find . -maxdepth 3 -name .ackrc' or inspect ACKRC environment variableAffected if A .ackrc file exists in the current working directory or any parent directory
-
Inspect .ackrc for --files-from directiveRead the contents of any found .ackrc files and search for the string '--files-from'Affected if The .ackrc file contains a --files-from option
-
Verify --files-from target pathExamine the argument following --files-from in the .ackrc file to see if it references paths outside the project (e.g., /etc/passwd, /etc/shadow, or parent directories using ../)Affected if The --files-from argument points to files or directories outside the expected project scope
A user is affected if App::Ack version 3.10.0 or lower is installed AND a project .ackrc file containing --files-from pointing to sensitive external files exists in or above the working directory.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataUpgrade to the latest App::Ack version once available and audit .ackrc files in untrusted repositories before running ack, or remove project .ackrc files from shared repositories.
- Consultation2.0 h
- Implementation2.0 h
- Testing1.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $1,744.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-49145 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-49145 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data