Backport fix for CVE-2026-8450 to perl-HTTP-Daemon.
HTTP::Daemon::ClientConn::send_file() used 2-arg open() which
allowed shell-magic interpretation of filenames, enabling RCE
and arbitrary file write. The fix switches to 3-arg open() with
an explicit '<' mode so filenames are treated as literal paths.
A new patch perl-HTTP-Daemon-6.12-CVE-2026-8450.patch was added,
combining two upstream commits: 945d351 (the send_file() fix with
hardened binmode handling and '0E0' return value) and de619f3
(regression tests for shell-magic filename shapes).
CVE: CVE-2026-8450
Upstream patches:
- 945d35141d.patch
- de619f3eb8.patch
Resolves: RHEL-184822
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
