Arbitrary File Write Vulnerability in Perforce P4 Search Software
CVE-2026-103511

5.1MEDIUM

Key Information:

Vendor

Perforce

Status
P4 (helix Core)
Vendor
CVE Published:
5 October 2026

What is CVE-2026-103511?

Perforce P4 Search prior to version 2026.4.2 is susceptible to an arbitrary file write vulnerability due to insufficient validation of filenames during the extension installation process. An attacker with super-user or service-token privileges could exploit this flaw to write arbitrary files to the P4 Search installation directory, potentially compromising the system's security and integrity.

Affected Version(s)

P4 (Helix Core) 0 <= 2026.4.1

P4 (Helix Core) 0 <= 2026.4.1

P4 (Helix Core) 2026.4.2

References

https://portal.perforce.com/s/cve/a91Qi000003FDpdIAG/arbi...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khoa Bui (https://github.com/zenniskayy2k4)
.