All vulnerabilities
CVE-2026-103511

P4 (Helix Core): Arbitrary file-write via extension installation in P4Search

Perforce P4 (Helix Core)
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published5 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.

Text from CVE List

Affected versions 2

  • P4 (Helix Core)affected: all versions through 2026.4.1CVE List
  • P4 (Helix Core)unaffected: 2026.4.2CVE List

References 1