Bug 2415451 (CVE-2025-64756)

Summary: CVE-2025-64756 glob: glob: Command Injection Vulnerability via Malicious Filenames
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aarif, aazores, abarbaro, abrianik, abuckta, adudiak, akostadi, alcohan, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, aoconnor, aprice, aschwart, asoldano, ataylor, bbaranow, bbrownin, bdettelb, bmaxwell, bniver, boliveir, bparees, brasmith, brian.stansberry, bsmejkal, carogers, caswilli, chfoley, cmah, cochase, darran.lofthouse, dbosanac, dbruscin, dfreiber, dhanak, dkuc, dmayorov, doconnor, dosoudil, dranck, drosa, drow, dsimansk, dymurray, eaguilar, ebaron, ehelms, erezende, eric.wittmann, fjuma, flucifre, ggainey, ggrzybek, gmalinko, gmeno, gparvin, groman, haoli, hasun, hkataria, ibek, ibolton, istudens, ivassile, iweiss, jachapma, jajackso, janstey, jbalunas, jburrell, jcammara, jcantril, jchui, jfula, jhe, jkoehler, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jolong, jowilson, jprabhak, jreimann, jrokos, juwatts, kaycoth, kegrant, kingland, koliveir, kshier, ktsao, kvanderr, kverlaen, lball, lchilton, lphiri, mabashia, manissin, matzew, mbenjamin, mdessi, mhackett, mhulan, mnovotny, mosmerov, mpierce, mposolda, mrizzi, msvehla, mwringe, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, ometelka, orabin, osousa, owatkins, pahickey, pantinor, parichar, pberan, pbizzarr, pbohmill, pbraun, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, progier, psrna, ptisnovs, rchan, rhaigner, rjohnson, rkubis, rmartinc, rojacob, rstancel, rstepani, sausingh, sdawley, sfeifer, shvarugh, simaishi, slucidi, smaestri, smallamp, smcdonal, sostapov, spichugi, sseago, ssidhaye, ssilvert, stcannon, sthorger, swoodman, syedriko, tasato, tbordaz, teagle, tfister, thavo, tmalecek, tom.jenkinson, tsedmik, vashirov, vereddy, veshanka, vkumar, vmuzikar, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in glob. This vulnerability allows arbitrary command execution via processing files with malicious names when the glob command-line interface (CLI) is used with the -c/--cmd option, enabling shell metacharacters to trigger command injection.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2418530, 2418531, 2418533, 2418534, 2418535, 2418536, 2418537, 2418539, 2418540, 2418546, 2419960, 2419961, 2418529, 2418532, 2418538    
Bug Blocks:    

Description OSIDB Bzimport 2025-11-17 18:01:51 UTC 
Glob matches files using patterns the shell uses. From versions 10.3.7 to 11.0.3, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c <command> <patterns> are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in version 11.1.0.