CVE-2025-30673

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-30673
Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html
https://metacpan.org/dist/Sub-HandlesVia/changes#L12
https://metacpan.org/release/TOBYINK/Sub-HandlesVia-0.050001/source/lib/Sub/HandlesVia/Mite.pm#L114
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) Sub::HandlesVia para Perl anterior a la versión 0.050002 permite cargar código no confiable del directorio de trabajo actual ('.') de forma similar a CVE-2016-1238. Si un atacante coloca un archivo malicioso en el directorio de trabajo actual, este podría cargarse en lugar del archivo deseado, lo que podría provocar la ejecución de código arbitrario. Sub::HandlesVia utiliza Mite para generar la sección de código afectada debido a CVE-2025-30672.

01 Apr 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

01 Apr 2025, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-01 03:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-30673

Mitre link : CVE-2025-30673

CVE.ORG link : CVE-2025-30673

JSON object : View

Products Affected

No product.

CWE
CWE-427

Uncontrolled Search Path Element