CVE-2026-103511 — Arbitrary file-write via extension installation in P4Search
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can wri…
Published: 2026-10-05 · CVSS: 5.1 · CVSS 4.0
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7