All vulnerabilities
CVE-2026-103508

P4 (Helix core): Path traversal via logging configuration in P4Search

Perforce P4 (Helix core)
Open in ThreatlineRecord JSON
CVSS
7.3High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published15 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier.

Perforce resolved it in 2026.4.3.

Text from CVE List

Affected versions 2

  • P4 (Helix core)affected: all versions through 2026.4.2CVE List
  • P4 (Helix core)unaffected: 2026.4.3CVE List

References 1