CVE-2026-103508

Executive Summary

CVE-2026-103508 is a relative path traversal vulnerability (CWE-23) in P4 Search (formerly Helix Search), a code search and indexing component for Perforce P4 (Helix Core). An authenticated user with administrative privileges on the connected P4 Server can supply a crafted logging configuration that causes the P4 Search service to write to or delete files outside the intended logging directory. Because the affected file operation occurs in the context of the P4 Search service account, successful exploitation can escalate to arbitrary code execution on the host. The issue affects P4 Search 2026.4.2 and earlier and was resolved by Perforce in 2026.4.3.

Technical Analysis

The vulnerability class is CWE-23 (Relative Path Traversal). The attack surface is the logging configuration interface of P4 Search. According to the NVD description, an authenticated user who holds administrative privileges on the connected P4 Server can supply a crafted logging configuration. P4 Search consumes that configuration and, instead of constraining all log output to a dedicated logging directory, honors attacker-controlled path segments that resolve outside that directory.

Two primitive operations are exposed: (1) file write outside the intended logging directory, and (2) file delete outside the intended logging directory. The description does not specify the exact configuration keys, parameter names, or parsing routines involved, and no such implementation detail should be assumed. What is derivable from the description is the trust boundary failure: a server-side administrative identity that should be confined to a search/indexing service is treated as authoritative for filesystem path selection by a co-located service process.

The two primitives combine into a classic write-and-execute chain. If the P4 Search service account can be induced to overwrite a file that is later consumed by a process running under the same account (for example, a configuration, startup, library, or scheduled-task artifact), the attacker gains code execution as the P4 Search service account. The delete primitive supports denial of service and can also be used destructively — removing files the service account is permitted to unlink, or clearing paths to force re-creation with attacker-controlled content.

Two contextual factors amplify the risk. First, the trigger is a legitimate authenticated identity with administrative rights on the P4 Server, meaning this is not an anonymous remote attack; it is a privileged-to-privileged escalation crossing from the P4 Server administrative plane into the P4 Search host's filesystem. That crossing is the actual security boundary violated. Second, P4 Search is a connected service — it holds credentials and network access to the P4 Server it indexes. Code execution under the P4 Search service account therefore yields access to whatever repository data, credentials, and network paths that service account can reach.

No public proof-of-concept, Nuclei template, or exploit code is known for this CVE. The attack chain below is inferred at the vulnerability-class level from the NVD description.

Exploitation Scenarios

1. Reconnaissance / target identification. An attacker already possessing administrative credentials on a P4 Server enumerates connected services and identifies a P4 Search / Helix Search instance at version 2026.4.2 or earlier. No network scanning of an unauthenticated target is required — the entry point is the administrative connection between P4 Server and P4 Search.

2. Triggering the flaw class. Using their P4 Server administrative privileges, the attacker supplies a crafted logging configuration to P4 Search. The crafted configuration contains path components that traverse relative to the intended logging directory, rather than being confined to it. This is the CWE-23 relative path traversal condition. Because the configuration is accepted from an administrative identity, no additional bypass of an authorization check is required — the missing control is path canonicalization and confinement, not authentication.

3. Payload / execution method. At the vulnerability-class level, the write primitive is used to place attacker-influenced content at a path outside the logging directory. The delete primitive is used to remove files outside the logging directory. Where a written path happens to be consumed by a process, a subsequent execution by the P4 Search service account yields code execution. The description does not specify which files are practical targets, and this report does not invent them; the general mechanism is arbitrary file write plus arbitrary file delete within the privileges of the service account.

4. Post-exploitation impact. Code execution as the P4 Search service account. That account is connected to the P4 Server, so the attacker can potentially reach repository content, service-held credentials, and any network-accessible resource the service account can address. The delete primitive additionally supports destructive denial of service and anti-forensics.

Impact Assessment

NVD has not published a CVSS score or vector for this CVE. The estimate used in the METADATA block (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects: network reachability of the administrative interface; low attack complexity once the configuration surface is understood; high privileges required (P4 Server admin); no user interaction; and high confidentiality, integrity, and availability impact given arbitrary file write/delete and resultant code execution.

Blast radius is bounded by the privileges and network reach of the P4 Search service account, not by the attacker's original P4 Server role alone. In deployments where P4 Search runs with broad filesystem rights or holds credentials to downstream systems, the impact extends beyond the search service host to indexed repositories and connected infrastructure. The confidentiality impact is high because repository contents and credentials may be exposed; integrity impact is high because files can be overwritten and deleted; availability impact is high because arbitrary deletion and destructive code execution can take the service and dependent workflows offline. CISA KEV status is NO, and no exploit-in-the-wild evidence is available.

Detection Guidance

Sigma Rule

title: P4 Search Logging Configuration Path Traversal (CVE-2026-103508)
id: 7f5c2a91-3d8e-4b17-9c60-2a6d5e1f8b34
status: experimental
description: Detects crafted logging configuration values containing relative path traversal sequences submitted to P4 Search / Helix Search, consistent with CVE-2026-103508.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103508
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: p4search
detection:
  selection_path:
    - log.path|contains:
        - '../'
        - '..\'
        - '%2e%2e%2f'
        - '%2e%2e%5c'
    - logging.directory|contains:
        - '../'
        - '..\'
  selection_config:
    event.action|contains:
      - 'logging.config'
      - 'log.config'
      - 'configure.logging'
  condition: selection_config and selection_path
falsepositives:
  - Legitimate administrative configuration changes that unintentionally include parent-directory references.
level: high
tags:
  - attack.t1212
  - attack.t1190
  - cve.2026.103508

YARA Rule

rule CVE_2026_103508_P4Search_PathTraversal
{
    meta:
        author = "valtersit.com"
        description = "Detects P4 Search logging configuration payloads using relative path traversal for CVE-2026-103508"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103508"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "logging" ascii nocase
        $s2 = "logpath" ascii nocase
        $s3 = "log.path" ascii nocase
        $s4 = "logFilePath" ascii nocase
        $t1 = "../" ascii
        $t2 = "..\\" ascii

    condition:
        (any of ($s1, $s2, $s3, $s4)) and (any of ($t1, $t2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103508 P4 Search Logging Configuration Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"log"; nocase; http.request_body; content:"../"; nocase; http.request_body; content:"logging"; nocase; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-103508; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026103508; rev:1;)

Note: the URI fragment "log" and body tokens are heuristic matchers for logging-configuration submissions; adjust to the actual deployment endpoint observed in the environment.

Elastic Detection

sequence by user.name with maxspan=5m
  [ any where event.category == "authentication" and event.outcome == "success" and user.roles : "admin" ]
  [ any where event.category == "configuration" and
      (process.args : "*../*" or process.args : "*..\\*" or
       file.path : "*../*" or file.path : "*..\\*") ]

Splunk SPL Query

index=p4search OR index=helix (sourcetype=p4search:config OR sourcetype=helix:search)
| search ("logging" OR "log_path" OR "logpath" OR "log.directory")
| search ("../" OR "..\\" OR "%2e%2e%2f" OR "%2e%2e%5c")
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users by host src_ip
| where count > 0

Wazuh OSSEC Rule

<group name="p4search,cve-2026-103508,">
  <rule id="100508" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">\.?(logging|log)\.?config</field>
    <field name="log.path" type="pcre2">\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c</field>
    <description>CVE-2026-103508: P4 Search logging configuration path traversal attempt detected</description>
    <mitre>
      <id>T1212</id>
      <id>T1190</id>
    </mitre>
    <group>p4search,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor states the issue was resolved in P4 Search 2026.4.3, but no tracked source corroborates a patch artifact tied to this CVE.

1) Immediate mitigations. Restrict who holds administrative privileges on P4 Servers connected to P4 Search; treat P4 Server admin as a highly sensitive role. Segregate the P4 Search service account so it has the minimum filesystem rights required for its logging directory, with no write or delete permission outside that directory. Apply filesystem ACLs and mount options to prevent the service account from unlinking or overwriting files beyond its scope. Monitor logging-configuration changes for traversal sequences.

2) Patch / upgrade steps. Upgrade P4 Search to 2026.4.3 or later, as stated by the vendor. Verify the deployed version after upgrade and confirm the logging-configuration handling no longer permits paths outside the logging directory. Because patch confidence from tracked sources is zero, independently validate the vendor advisory before relying on the fix.

3) Long-term hardening. Treat cross-service administrative trust as a boundary requiring explicit authorization and path canonicalization; never let one service's admin identity dictate filesystem paths in another service. Enforce allow-listed base directories for all log operations. Run P4 Search under a dedicated low-privilege account isolated from other services. Enable integrity monitoring on files outside the logging directory and alert on unexpected writes or deletions by the P4 Search process. Review service-account network reach to limit post-exploitation exposure to connected P4 Servers.

References

• NVD — CVE-2026-103508: https://nvd.nist.gov/vuln/detail/CVE-2026-103508
• Perforce (Helix Core / P4 Search) security advisories — consult the vendor advisory portal for the 2026.4.3 release notice.
• CWE-23, Relative Path Traversal: https://cwe.mitre.org/data/definitions/23.html
• MITRE ATT&CK T1212 — Exploitation for Credential Access: https://attack.mitre.org/techniques/T1212/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed; status NO as of this report).

No public proof-of-concept, exploit code, Nuclei template, or threat-actor campaign has been observed for this CVE. No evidence of exploitation in the wild is available.