A path traversal and link following vulnerability in HMBRAND DBD::File allows local users to read or write arbitrary files, posing a high risk to system integrity and confidentiality.

This vulnerability involves improper limitation of a pathname to a restricted directory and improper link resolution, where the complete_table_name method builds absolute file paths without checking for symbolic links, requiring no privileges to exploit locally.

A successful exploit of this vulnerability could lead to unauthorized read and write access to sensitive files outside the intended data directory on the host system. With a CVSS score of 7.7, the severity is classified as high, reflecting the potential for significant data compromise and system manipulation by local actors.

Immediate Action: Update HMBRAND DBD::File to version 1.651 or later.

Proactive Monitoring: Monitor file access logs for unusual patterns or attempts to create symbolic links within the data directory.

Compensating Controls: Ensure strict file system permissions on the data directory and underlying storage volumes to limit local user access.

Public Exploit Available: false

Given the high severity rating and potential for unauthorized file access, administrators should apply the update to version 1.651 immediately. Prompt patching is essential to prevent local privilege escalation and protect sensitive system files from unauthorized modification or disclosure.