CVE-2026-103507

Executive Summary

CVE-2026-103507 is a path traversal-class arbitrary file write vulnerability (CWE-73: External Control of File Name or Path) in Perforce P4 Search versions prior to 2026.4.2. The product fails to restrict file paths supplied through its logging configuration interface, allowing an attacker who already holds the service authentication token to write files to arbitrary locations on the host. Because the P4 Search service account's write permissions govern where files can be placed, successful exploitation can escalate to arbitrary code execution in the context of that service account, making this a high-impact post-authentication vulnerability for organizations running exposed or internally reachable P4 Search deployments.

Technical Analysis

P4 Search is Perforce's indexing and search service used in conjunction with Helix Core (P4) environments. This vulnerability resides in the component that processes logging configuration — a management interface that accepts configuration input (including file path values) and persists that configuration to disk.

The core defect is CWE-73, External Control of File Name or Path. The NVD description states that P4 Search "does not restrict file paths written through its logging configuration interface." This means the application accepts a path value from configuration input and uses it directly as the destination for a write operation without canonicalizing the path, validating it against an allow-list, or constraining it to an expected logging directory. In practice, this class of flaw allows a relative traversal sequence or an absolute path to redirect the write outside the intended log directory and onto any location the process can reach.

Two preconditions define the attack surface and constrain the threat model:

1. Authentication is required. The attacker must "hold the service authentication token." This is not an unauthenticated, internet-wide exploit. The privileged position required is possession of the token used to authenticate to the P4 Search service — obtained through credential leakage, configuration file access, lateral movement, or a compromised integration.
2. The logging configuration interface is the injection vector. The untrusted input is a path value in log configuration, not search queries or indexed content.

The impact chain is significant precisely because of where log files are typically written: the filesystem. Writing an arbitrary file as the service account means the attacker controls file content and destination path. Depending on the host OS and the service account's privileges, this can be leveraged toward code execution — for example, by overwriting or planting files that the service or another privileged process subsequently executes or sources. The NVD description explicitly notes the potential "to execute code as the P4 Search service account," framing code execution as a downstream consequence of the arbitrary write rather than a direct memory-corruption primitive.

No CVSS vector is published in the source data (CVSS: N/A), and FIRST.org has not yet assigned an EPSS score. The vector shown in METADATA is an analyst-proposed baseline reflecting network reachability, low attack complexity, and the requirement for a valid token (PR:L); it should be treated as provisional until a vendor or NVD vector is published. No functional exploit code, PoC, or Nuclei template is publicly available at the time of writing.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class and the NVD description. No specific function names, endpoints, or parameter names are provided in the source data, so this section is deliberately described at the mechanism level.

1. Reconnaissance / target identification. The attacker identifies a reachable P4 Search instance, prior to 2026.4.2, within a targeted environment. Discovery may be passive (internal asset inventory, scan data) or active (HTTP fingerprinting of the P4 Search web/indexing interface). The attacker then determines the service version to confirm it falls in the affected range.

2. Prerequisite: obtain the service authentication token. Because exploitation requires the token, this step is the gating action. Realistic acquisition paths include: reading the token from a configuration or secrets file on a host the attacker has already accessed; intercepting it from an unencrypted management channel; harvesting it from a compromised CI/CD job, script, or backup; or obtaining it via lateral movement inside a network where P4 Search is deployed. Without this token, the vulnerability is not reachable.

3. Triggering the flaw. Authenticated to the logging configuration interface, the attacker submits a configuration value that supplies a file path outside the intended logging directory. Because the interface does not restrict the path, the application writes to the attacker-supplied location. No specific parameter name is disclosed in the source data; the injection point is characterized only as the logging configuration interface.

4. Payload / execution method (vulnerability-class level). Arbitrary file write via path control is weaponized by choosing a destination path whose content will later be interpreted or executed. At the class level, common techniques include overwriting files consumed by the service at startup or reload, or planting content in a location the service account can execute. The NVD description explicitly warns this "potentially leads to code execution as the P4 Search service account." The exact execution primitive depends on filesystem layout and permissions, which are not disclosed.

5. Post-exploitation impact. With code execution under the P4 Search service account, the attacker operates with that account's filesystem, network, and process privileges — enabling data access to indexed content and configuration, persistence, and a pivot into the broader Perforce/Helix Core environment. Integrity of indexed data and availability of the search service are also at risk.

Impact Assessment

Business impact. P4 Search indexes source code and repository metadata, so compromise can expose proprietary source code and intellectual property, not just log data. Successful code execution as the service account represents a foothold inside the development infrastructure — a high-value target for supply-chain-oriented intrusion.

Affected systems. Any deployment of Perforce P4 Search running a version prior to 2026.4.2. Because the vendor reports the fix in 2026.4.2, all earlier releases within the product's supported line must be assumed vulnerable absent contrary vendor guidance.

Blast radius. Scoped to systems where the P4 Search service runs and its account's filesystem reach extends. Where that account has broad privileges, blast radius widens to co-located services and mounted volumes. The authentication-token prerequisite limits opportunistic mass exploitation but does not reduce severity once initial access exists.

CVSS subscores (proposed; not vendor-published). Network (AV:N), Low complexity (AC:L), Privileges required (PR:L — the token), No user interaction (UI:N), High Confidentiality/Integrity/Availability (C:H/I:H/A:H). Note that CVSS is officially N/A in the source data; the vector above is an analytical estimate and must be labeled as such. EPSS is not yet scored by FIRST.org.

Detection Guidance

Detection focuses on the two observable stages: (a) anomalous authenticated access to the logging configuration interface and (b) filesystem writes to paths outside the expected logging directory by the P4 Search service account.

Sigma Rule

title: P4 Search Logging Configuration Path Traversal Arbitrary File Write
id: 7f3c9a21-4b6e-4d2a-9c1e-1a2b3c4d5e6f
status: experimental
description: Detects file creation or modification by the Perforce P4 Search process in paths outside the expected logging directory, consistent with CVE-2026-103507.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103507
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\p4search.exe'
      - '\p4search'
    Image|contains:
      - 'P4Search'
      - 'p4search'
  selection_paths:
    TargetFilename|contains:
      - '\Temp\'
      - '\Windows\Temp\'
      - '\Startup\'
      - '/tmp/'
      - '/etc/'
      - '/var/www/'
  filter_expected_logs:
    TargetFilename|contains:
      - '\logs\'
      - '\log\'
  condition: selection_process and selection_paths and not filter_expected_logs
falsepositives:
  - Legitimate administrative reconfiguration of log output paths
level: high

YARA Rule

rule CVE_2026_103507_P4Search_LogPath_Traversal
{
    meta:
        description = "Detects P4 Search logging configuration content referencing paths outside the expected log directory, consistent with CVE-2026-103507"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103507"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cfg1 = "log" ascii nocase
        $cfg2 = "logging" ascii nocase
        $traverse1 = "../" ascii
        $traverse2 = "..\\" ascii
        $abs1 = "/etc/" ascii
        $abs2 = "/tmp/" ascii
        $abs3 = "C:\\Windows\\Temp" ascii nocase

    condition:
        filesize < 1MB and
        (any of ($cfg1, $cfg2)) and
        (any of ($traverse1, $traverse2, $abs1, $abs2, $abs3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103507 Perforce P4 Search Logging Config Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"log"; nocase; http.request_body; content:".."; http.request_body; content:"/"; distance:0; http.request_body; pcre:"/(\.\.\/|\.\.\\\\|\/etc\/|\/tmp\/|Windows\\\\Temp)/i"; classtype:attempted-admin; sid:2026103507; rev:1; reference:cve,2026-103507; metadata:service http;)

Note: This rule is heuristic — no exact endpoint or parameter name is disclosed by the vendor. Tune the http.uri match to the actual P4 Search logging configuration path observed in your environment.

Elastic Detection

file where process.name in ("p4search", "p4search.exe") and
  file.path != null and
  not file.path : ("*\\logs\\*", "*/logs/*", "*\\log\\*", "*/log/*") and
  (file.path : ("*\\Temp\\*", "/tmp/*", "/etc/*", "*\\Startup\\*"))

This EQL query flags P4 Search file writes landing outside expected log directories. Adjust the expected-path exclusion list to reflect your deployment's configured logging location.

Splunk SPL Query

index=main (sourcetype=WinEventLog:Security OR sourcetype=linux:audit OR sourcetype=sysmon)
(process_name="p4search" OR process_name="p4search.exe" OR Image="*p4search*")
(EventCode=11 OR type=SYSCALL OR action=file_created OR action=file_modified)
(TargetFilename="*\\Temp\\*" OR TargetFilename="/tmp/*" OR TargetFilename="/etc/*" OR TargetFilename="*\\Startup\\*")
NOT (TargetFilename="*\\logs\\*" OR TargetFilename="*/logs/*")
| stats count values(TargetFilename) as written_files by host, user, process_name
| where count > 0

Wazuh OSSEC Rule

<group name="perforce,p4search,">
  <rule id="103507" level="12">
    <if_sid>550</if_sid>
    <field name="file">\.(exe|dll|sh|so|py|jsp|php|conf|properties)$</field>
    <match>p4search|P4Search</match>
    <description>CVE-2026-103507: P4 Search wrote a file outside its expected logging directory - possible path traversal arbitrary file write.</description>
    <mitre>
      <id>T1190</id>
      <id>T1505.003</id>
    </mitre>
  </rule>
</group>

Wazuh rule 103507 chains off the built-in file-integrity monitoring parent rule (550) and fires when the P4 Search process is associated with a write to a non-log directory. Tune the match against the P4 Search service account name in your deployment.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Although the NVD description references a fix in 2026.4.2, no patch artifact, release note, or vendor advisory was located by tracked sources. Treat remediation as unverified until the vendor publishes an authoritative advisory.

1) Immediate mitigations (until patch is validated):

• Restrict network access to the P4 Search logging configuration interface to trusted management networks only; do not expose it to untrusted or internet-facing segments.
• Rotate and strictly protect the P4 Search service authentication token. Audit where the token is stored (config files, scripts, CI/CD secrets) and eliminate plaintext copies. Token compromise is the required precondition for exploitation.
• Run the P4 Search service under a dedicated, least-privilege account with write access confined to a single logging directory; use filesystem controls (ACLs, mount options, container read-only root filesystems) to prevent writes elsewhere.
• Place P4 Search on an isolated host or container with a read-only root filesystem and a dedicated writable volume for logs.

2) Patch/upgrade steps:

• Confirm the exact version in use via the service's version reporting.
• Upgrade to P4 Search 2026.4.2 once the vendor advisory is published and the build is verified (checksums, vendor portal). Validate the fix by confirming that the logging configuration interface no longer accepts paths outside the intended logging directory.
• Because patch evidence is currently absent, do not treat any third-party build as authoritative without vendor confirmation.

3) Long-term hardening:

• Enforce path canonicalization and allow-listing for all configuration values that feed file operations; reject absolute paths and traversal sequences at input validation.
• Apply least-privilege service-account design and mandatory access controls (SELinux/AppArmor) to constrain the blast radius of any future arbitrary-write flaw.
• Add file-integrity monitoring on P4 Search hosts to alert on writes outside log directories (see Detection Guidance).
• Adopt centralized secrets management for the service token and monitor for anomalous authenticated configuration changes.
• Track the vendor's release/advisory channel for the authoritative 2026.4.2 patch and re-assess patch confidence once evidence is available.

References

• NVD — CVE-2026-103507: https://nvd.nist.gov/vuln/detail/CVE-2026-103507
• MITRE CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Perforce product security / advisory channel: https://www.perforce.com/security (check for the P4 Search 2026.4.2 advisory)
• FIRST.org EPSS (score pending): https://www.first.org/epss/

Threat actor / in-the-wild status: No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-103507 at the time of writing. The vulnerability is not listed in CISA KEV. No public PoC, exploit code, or Nuclei template is available. CVSS and EPSS scores are unpublished; this should be re-evaluated as vendor and threat-intelligence data become available.