medium5.1
CVE-2026-103511
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature.
Impact
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Perforce | Perforce P4 Search | before 2026.4.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.