Path Traversal Vulnerability in P4 Search by Perforce
CVE-2026-103508

7.3HIGH

Key Information:

Vendor

Perforce

Status
P4 (helix Core)
Vendor
CVE Published:
15 October 2026

What is CVE-2026-103508?

An authenticated user with administrative privileges in P4 Search can exploit a vulnerability by supplying a malicious logging configuration. This configuration allows for unauthorized access, enabling files to be written or deleted outside the designated logging directory. Such an exploit could lead to code execution as the P4 Search service account, compromising the server's integrity. Users are advised to upgrade to version 2026.4.3 or later to mitigate this risk.

Affected Version(s)

P4 (Helix core) 0 <= 2026.4.2

P4 (Helix core) 2026.4.3

References

https://portal.perforce.com/s/cve/a91Qi000003GdOfIAK/path...

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.