CVE-2026-103507 — Arbitrary file-write via log configuration path in P4Search

CVE-2026-103507

Arbitrary file-write via log configuration path in P4Search PUBLISHED

Description (CNA)

Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.

Affected (CNA)

Vendor / product	Versions
Perforce / P4 (Helix Core)	affected 0 through 2026.4.1; unaffected 2026.4.2

CWE

CWE-73

References

https://portal.perforce.com/s/cve/a91Qi000003FE49IAG/arbitrary-filewrite-via-log-configuration-path-in-p4search

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.