CVE-2026-103511

Executive Summary

CVE-2026-103511 is a path/file-name validation flaw (CWE-73: External Control of File Name or Path) in Perforce P4 Search prior to version 2026.4.2. The extension installation feature accepts file names without adequate validation, allowing an attacker who already holds super-user or service-token privileges to write files with arbitrary content into the P4 Search installation directory. Because the write is constrained to the installation directory and requires elevated privileges, the immediate risk is primarily to confidentiality and integrity of the search service and its configuration/install footprint rather than unauthenticated remote code execution.

Technical Analysis

The vulnerability resides in the extension installation workflow of P4 Search. According to the NVD description, the product "does not validate file names supplied to its extension installation feature." This is a classic CWE-73 condition: an externally influenced file name is used to determine the destination of a file write without sanitizing path separators, traversal sequences, or absolute path components. The practical consequence is that the destination path of the written file is attacker-influenced.

Key characteristics of the flaw class:

• Trust boundary crossing: The file name originates from a caller-supplied value (the extension installation request). The application trusts this value as benign and uses it directly when constructing the target path.
• Privilege requirement: Exploitation requires super-user or service-token privileges. This is not an unauthenticated bug; it is a privileged misuse or privilege-escalation-to-file-write primitive. An attacker who has already obtained such credentials (or a token with equivalent scope) can expand their capabilities from "application operator" to "arbitrary file writer within the install tree."
• Impact scope: The write destination is the P4 Search installation directory. Depending on what files can be overwritten (configuration, extension artifacts, scripts bundled with the service, or dependencies), the attacker can influence the behavior of the search service and, transitively, the Perforce environment it indexes/serves.

No public technical write-up, function name, URL endpoint, or API parameter is available in the provided data. The CNA title and NVD description do not disclose the specific request format or parameter name used by the extension installer. Accordingly, the mechanism is described at the vulnerability-class level: unsanitized file-name input in a privileged file-write operation leading to arbitrary-content file creation/overwrite within the installation directory.

Note on CVSS: No CVSS score or vector was provided by the source data. The vector listed in METADATA is a derived, defensible estimate reflecting Network attack vector, Low complexity, High privileges required, No user interaction, and High confidentiality/integrity impact with no scope change. It must be treated as analyst-derived, not vendor-published.

Exploitation Scenarios

Because no public PoC or exploit code exists, the following chain is inferred strictly from the vulnerability class (CWE-73) and the NVD description. No specific function names, endpoints, or parameter names are asserted because they do not appear in the source data.

1. Reconnaissance / target identification: The attacker locates an exposed or reachable P4 Search instance (search UI, management interface, or API surface) and determines the version is prior to 2026.4.2. The attacker must already possess super-user credentials or a valid service token — obtained through prior compromise, credential reuse, or insider access.

2. Triggering the flaw: The attacker invokes the extension installation feature and supplies a crafted file name. Because the product does not validate that file name, the attacker includes path-control characters (e.g., traversal sequences or absolute-path components, applied at the vulnerability-class level) so that the destination path resolves outside the intended extension directory and into a location of the attacker's choosing inside the installation directory.

3. Payload / execution method: The attacker supplies file content of their choice, and the installer writes that content to the attacker-influenced path. At the class level, the primitive is arbitrary file write within the installation directory — it does not, by itself, establish code execution in the NVD description. Escalation to execution would depend on whether a writable target is later loaded, executed, or interpreted by the service, which the provided data does not confirm.

4. Post-exploitation impact: The attacker can overwrite or plant files inside the P4 Search installation directory. This can tamper with service configuration, persist modified extension artifacts, or corrupt/poison files the service trusts, degrading integrity and potentially availability. Because no execution primitive is confirmed, the primary demonstrated impact is unauthorized file creation/overwrite with attacker-chosen content.

Caveat: No public PoC available; attack chain is inferred from vulnerability class. The exact path-resolution behavior, writable locations, and any execution step are not specified in the source data and must not be assumed.

Impact Assessment

• Confidentiality (High): Arbitrary-content writes into the install tree can overwrite or expose sensitive configuration or credential-bearing files, and tampering may reveal or redirect data flows.
• Integrity (High): The core impact — the attacker controls file content at chosen paths within the installation directory.
• Availability (High): Overwriting or corrupting service files can disable or destabilize P4 Search.
• Privileges Required (High) / Attack Vector (Network): Exploitation demands super-user or service-token privileges, which materially reduces the exploitable population to already-authenticated, high-privilege actors or those who have completed a prior privilege-acquisition step.

Blast radius: Directly affected are organizations running Perforce P4 Search < 2026.4.2 with extension installation enabled and reachable. Secondary exposure extends to the Perforce environment that P4 Search indexes/serves, since tampering with the search service can affect downstream users, but the NVD description limits the file-write impact to the P4 Search installation directory. The requirement for super-user/service-token privileges means the typical unauthenticated internet attacker cannot exploit this directly; the realistic threat is insider abuse or post-compromise escalation.

Detection Guidance

Sigma Rule

title: Suspicious P4 Search Extension Installation with Path Traversal in File Name
id: 8b2f4c1e-1035-11ef-9a7c-0242ac120003
status: experimental
description: Detects extension installation activity targeting Perforce P4 Search where the supplied file name contains traversal or absolute path indicators, consistent with CWE-73 exploitation (CVE-2026-103511).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103511
author: valtersit.com
date: 2026/04/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/p4search'
      - '/p4_search'
      - 'p4search.exe'
  selection_args:
    CommandLine|contains:
      - '..%2f'
      - '../'
      - '..\\'
      - '/etc/'
      - '\\..\\'
  condition: selection_proc and selection_args
falsepositives:
  - Legitimate administrative extension installs using unusual relative paths (rare)
level: high
tags:
  - attack.t1190
  - cve.2026.103511

YARA Rule

rule CVE_2026_103511_P4Search_Extension_Write
{
    meta:
        description = "Detects P4 Search extension artifacts with embedded path traversal file names (CVE-2026-103511)"
        author = "valtersit.com"
        date = "2026-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103511"
        cve = "CVE-2026-103511"

    strings:
        $p4search = "p4search" ascii nocase
        $ext      = "extension" ascii nocase
        $trav1    = "../" ascii
        $trav2    = "..\\" ascii
        $trav3    = "%2e%2e%2f" ascii nocase

    condition:
        filesize < 2MB and
        $ext and
        any of ($trav*) and
        $p4search
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103511 Perforce P4 Search Extension Install Path Traversal Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"extension"; nocase; http.uri; content:".."; http.uri; content:"%2e%2e"; nocase; classtype:attempted-admin; reference:cve,2026-103511; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103511; sid:2026103511; rev:1;)

Note: This rule targets the vulnerability class (traversal-style file-name input during extension installation). Adjust http.uri matching to the deployment's actual install path — the endpoint is not specified in the source data.

Elastic Detection

process where event.type == "start" and
  process.name in ("p4search", "p4_search", "p4search.exe") and
  process.args : ("../*", "..\\*", "*%2e%2e%2f*", "*..\\*")

Splunk SPL Query

index=perforce OR index=webserver sourcetype IN ("access_combined","p4search:log")
| search ("extension" AND ("../" OR "..\\" OR "%2e%2e"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris values(clientip) as src_ips by user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Adjust index/sourcetype and field names (user, uri, clientip) to match the collected schema; P4 Search log formats are not specified in the source data.

Wazuh OSSEC Rule

<group name="perforce,p4search,">
  <rule id="100511" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">p4search|p4_search</field>
    <match>\.\./|\.\.\\|%2e%2e%2f</match>
    <description>Possible CVE-2026-103511 exploit: P4 Search extension installation with path traversal in file name</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_103511,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, patch commit, or release artifact was independently verified. The NVD description references a fixed version (P4 Search 2026.4.2 or later), but this has not been confirmed by a tracked source and should be validated directly with Perforce.

1. Immediate mitigations (while unpatched):

   • Restrict access to the P4 Search extension installation feature to the smallest possible set of trusted administrators; audit all super-user and service-token holders.
   • Rotate service tokens and enforce least-privilege scoping so that tokens cannot reach extension installation interfaces.
   • Network-restrict the P4 Search management/installation surface to trusted management networks; do not expose it to untrusted networks.
   • Enable file-integrity monitoring on the P4 Search installation directory to detect unexpected file creation/modification.
   • Deploy the detection rules above and alert on any extension install request or process invocation containing path-traversal indicators.

2. Patch / upgrade steps:

   • Confirm availability of P4 Search 2026.4.2+ directly with Perforce (no advisory was independently verifiable here). If confirmed, plan an upgrade window and back up the installation directory and configuration before upgrading.
   • After upgrade, verify the fix by testing the extension installation feature with traversal-style file names in a controlled environment and confirming rejection.

3. Long-term hardening:

   • Enforce strict allow-listing and canonicalization of all user-supplied file names before path construction; reject path separators, traversal sequences, and absolute paths.
   • Apply a defense-in-depth model: run the search service with minimal filesystem privileges and constrict write access to a dedicated, isolated directory.
   • Maintain SBOM/asset inventory for Perforce components to speed future vulnerability triage.
   • Monitor Perforce security advisories and CISA KEV for this CVE.

References

• NVD — CVE-2026-103511: https://nvd.nist.gov/vuln/detail/CVE-2026-103511
• CWE-73 — External Control of File Name or Path: https://cwe.mitre.org/data/definitions/73.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Perforce P4 Search product/security information (validate fixed version 2026.4.2 directly with vendor): https://www.perforce.com
• FIRST EPSS (no score available at time of writing): https://www.first.org/epss/

Threat actor campaign / exploit-in-the-wild evidence: None observed. CISA KEV: NO. No public PoC, no Nuclei template, and no exploit code were identified in the source data.