CVE-2026-49145: App::Ack Arbitrary File Read via Malicious .ackrc Configuration

Technical summary

App::Ack loads project-level configuration from .ackrc files by searching up the directory hierarchy. The ConfigLoader module maintains a blocklist of options that should not be allowed in untrusted project configs to prevent abuse. However, the --files-from option—which specifies a file containing a list of paths to search—was not included in this blocklist. An attacker can set --files-from in a committed .ackrc to point to a file path with carefully chosen targets. When ack executes, it reads the listed files and performs its search operation on them, effectively reading arbitrary file contents and printing matching lines. The vulnerability affects all versions through 3.10.0, though version 3.10.0 did add --follow to the blocklist, indicating partial awareness of similar risks.

Business impact

For development teams using App::Ack, this vulnerability enables information disclosure attacks through repository compromise. A malicious or compromised third-party project can leak sensitive data when developers run ack in their environment. Risks include exposure of configuration files, source code from other projects, environment secrets, or other files accessible to the user running ack. The impact depends on file access permissions and what an attacker can target, but in shared or CI/CD environments, the scope for damage increases. Teams relying on ack for code search should treat this as a disclosure risk, particularly when working with untrusted or open-source repositories.

Affected systems

App::Ack version 3.10.0 and all earlier versions are affected. The vulnerability is specific to the App::Ack Perl module and affects any system where ack is installed and used to search code within projects. Developers on Linux, macOS, and Windows systems running Perl and ack are potentially exposed if they clone repositories with malicious .ackrc files.

Exploitability

Exploitability is straightforward: an attacker needs only to commit a .ackrc file to a repository and include --files-from pointing to target files. No special privileges, authentication, or complex setup is required on the attacker's side. The vulnerability triggers automatically when a developer runs ack in the affected project directory. However, exploitation is limited by the file-system permissions of the user running ack and requires that the attacker know or guess useful file paths. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but the low barrier to attack makes timely patching important.

Remediation

The primary remediation is to update App::Ack to a patched version once released by the maintainers. In the interim, teams should avoid running ack on untrusted or unreviewed repositories and consider disabling or restricting ack's use in CI/CD pipelines until patches are available. Code review practices should include scrutiny of .ackrc files in pull requests from external contributors. Users can also configure tools to ignore or reject project .ackrc files if their ack version or wrapper supports such controls.

Patch guidance

Check the App::Ack project repository and CPAN for a patched release addressing CVE-2026-49145. Verify against the official vendor advisory for the exact version number and release date. Once available, apply the patch by updating the Perl module using your package manager (cpan, cpanm, or your OS distribution's package repository). Test the patched version to ensure ack still functions as expected for your workflows before deploying broadly.

Detection guidance

Review committed .ackrc files in your repositories, particularly in recently added or external-contribution branches, for suspicious --files-from options. Monitor filesystem access from ack processes in sensitive environments using syscall tracing or audit logs. If you suspect exposure, search your .ackrc history using git log to identify when and by whom a malicious option might have been introduced. Additionally, check execution logs to see if ack was run on affected projects by other developers or CI systems.

Why prioritize this

While the vulnerability requires repository access to exploit and has a moderate attack surface, the ease of attack and potential for sensitive data disclosure warrant prompt attention. Teams actively using ack should prioritize patching, especially those with CI/CD systems or shared development environments. The vulnerability is clearly exploitable and impacts confidentiality, justifying a HIGH severity rating.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible attack vector, low attack complexity, no privilege requirements, and no user interaction—all favorable to the attacker. However, the score assigns zero impact to confidentiality and integrity, focusing impact entirely on availability, which may understate the information-disclosure risk in practice. The actual business risk depends on which files an attacker can target and what data they contain in your environment.

Frequently asked questions