CVE-2025-30672 – Mite for Perl Arbitrary Code Execution Vulnerability

The following table lists the changes that have been made to the
CVE-2025-30672 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 9b29abf9-4ab0-4765-b253-1875cd9b441e

    Apr. 01, 2025

    Action Type Old Value New Value
    Added Description Mite for Perl before 0.013000 generates code with the current working directory (‘.’) added to the @INC path similar to CVE-2016-1238.

    If an attacker can place a malicious file in current working directory, it may be
    loaded instead of the intended file, potentially leading to arbitrary
    code execution.

    This affects the Mite distribution itself, and other distributions that contain code generated by Mite.

    Added CWE CWE-427
    Added Reference https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html
    Added Reference https://metacpan.org/release/TOBYINK/Mite-0.013000/changes
    Added Reference https://perldoc.perl.org/perlrun#PERL_USE_UNSAFE_INC
    Added Reference https://wiki.gentoo.org/wiki/Project:Perl/Dot-In-INC-Removal
Share the Post:

Related Posts