CVE-2011-10007

CVE-2011-10007 describes an arbitrary code execution vulnerability in File::Find::Rule through version 0.34 for Perl. This flaw allows an attacker to execute arbitrary commands when the grep() function processes a specially crafted filename. The vulnerability arises because the two-argument form of open() is used, allowing an attacker-controlled filename to dictate the MODE parameter, effectively turning the filename into an executable command. This vulnerability carries a high severity CVSS score of 8.8, indicating a critical risk. It can be exploited remotely with low attack complexity, requiring user interaction (e.g., processing a malicious file) to achieve high impacts on confidentiality, integrity, and availability. The CWE-78 classification highlights the command injection nature of the flaw. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or attention.