CVE-2026-103508Path traversal via logging configuration in P4Search
Updated under an hour ago ()
Does this affect you?
It affects Perforce P4 (Helix core). Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.42%, higher than 35% of scored CVEs.
Do this next
Free account, 1 product
P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3.
- CVSS
- 7.3 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
- Weakness (CWE)
- CWE-23
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.42% (percentile 35)
- Assigned by
- Perforce
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Perforce P4 (Helix core) perforce:p4_helix_core (from the name) | through 2026.4.2; 2026.4.3 not affected | CNA record |
References
- https://portal.perforce.com/s/cve/a91Qi000003GdOfIAK/path-traversal-via-logging-configuration-in-p4search
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.