High severity · published Oct 5, 2026
CVE-2026-103507
Arbitrary file-write via log configuration path in P4Search
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can write arbitrary files on the host, potentially leading to code execution as the P4 Search service account.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
P4 (Helix Core) · Perforce
through 2026.4.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103507
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103507
portal.perforce.com
https://portal.perforce.com/s/cve/a91Qi000003FE49IAG/arbitrary-filewrite-via-log-configuration-path-in-p4search
More from P4 (Helix Core)
9.5
CVE-2026-103510
Authentication bypass via blank auth token in P4Search
9.5
CVE-2026-100102
RCE via exposed JDWP debug agent in P4Search
8.5
CVE-2026-103509
Credential Disclosure in P4 Search Configuration API
7.7
CVE-2026-6902
Code Injection in Perforce P4 (Helix Core)
7.3
CVE-2026-103508
Path traversal via logging configuration in P4Search