CVE-2011-10007

Vendor solution

Users should update to a fixed version such as 0.35 or later, or apply the patch provided in the references section, or use a patched version provided by their OS distribution

Red Hat statement

This vulnerability marked as Important rather than Moderate because it enables arbitrary code execution (ACE) through a common and trusted interface—filename handling. Specifically, the use of Perl’s two-argument open() within the grep() method allows attacker-controlled filenames to be interpreted as shell commands when prefixed with special characters like |. Since File::Find::Rule is often used in automation scripts, system utilities, and recursive file operations, this flaw transforms a seemingly benign filename input into an execution vector, violating a core security boundary between data and code. The vulnerability does not require elevated privileges or complex exploitation chains; a single crafted filename is enough to trigger shell execution, making the flaw exploitable in real-world scenarios such as CI/CD pipelines or file indexing systems.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.