Untrusted search path in perl
Priority MEDIUM 60CWE-426Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 10 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-426.
Summary
Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00499 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial perl (perl): 5.41.13Red Hat: 8 advisoriesRed Hat: 10 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA perl (perl) Fixed in 5.41.13
Red Hat 8 advisories
- RHSA-2026:50262 Released 2026-08-04 · Red Hat rating Importantperl:5.32 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.ppc64le::perl:5.32, perl-4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.src::perl:5.32, perl-4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.x86_64::perl:5.32 +6
- Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.src::perl:5.32, perl-4:5.32.1-472.module+el8.8.0+24404+b3ad2701.1.x86_64::perl:5.32, perl-IO-Compress-2.096-1.module+el8.8.0+24435+247ee4c9.1.noarch::perl:5.32 +3
- RHSA-2026:37070 Released 2026-07-09 · Red Hat rating Moderateperl:5.32 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) perl-4:5.32.1-471.module+el8.6.0+24484+7827d5b5.1.src::perl:5.32, perl-4:5.32.1-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32, perl-Algorithm-Diff-1.1903-10.module+el8.6.0+13324+628a2397.noarch::perl:5.32 +47
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) perl-4:5.32.1-471.module+el8.6.0+24484+7827d5b5.1.src::perl:5.32, perl-4:5.32.1-471.module+el8.6.0+24484+7827d5b5.1.x86_64::perl:5.32, perl-Algorithm-Diff-1.1903-10.module+el8.6.0+13324+628a2397.noarch::perl:5.32 +47
- RHSA-2026:8096 Released 2026-04-14 · Red Hat rating Moderateperl:5.32 security update
- Red Hat Enterprise Linux AppStream (v. 8) perl-4:5.32.1-474.module+el8.10.0+24099+8aa2f756.aarch64::perl:5.32, perl-4:5.32.1-474.module+el8.10.0+24099+8aa2f756.ppc64le::perl:5.32, perl-4:5.32.1-474.module+el8.10.0+24099+8aa2f756.s390x::perl:5.32 +47
Show 5 more Red Hat advisories
- RHSA-2025:13267 Released 2025-08-06 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9
- RHSA-2025:12056 Released 2025-07-29 · Red Hat rating Moderateperl security update
- Red Hat Enterprise Linux AppStream (v. 10) perl-4:5.40.2-512.2.el10_0, perl-Attribute-Handlers-1.03-512.2.el10_0, perl-AutoLoader-5.74-512.2.el10_0 +47
- RHSA-2025:11804 Released 2025-07-28 · Red Hat rating Moderateperl security update
- Red Hat Enterprise Linux AppStream (v. 9) perl-4:5.32.1-481.1.el9_6, perl-Attribute-Handlers-1.01-481.1.el9_6, perl-AutoLoader-5.74-481.1.el9_6 +47
- RHSA-2025:11805 Released 2025-07-28 · Red Hat rating Moderateperl security update
- Red Hat Enterprise Linux AppStream (v. 8) perl-4:5.26.3-423.el8_10, perl-Attribute-Handlers-0.99-423.el8_10, perl-Devel-Peek-1.26-423.el8_10 +16
- Red Hat Enterprise Linux BaseOS (v. 8) perl-4:5.26.3-423.el8_10, perl-Errno-1.28-423.el8_10, perl-IO-1.38-423.el8_10 +5
- RHSA-2025:11545 Released 2025-07-22 · Red Hat rating Moderateperl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) perl-4:5.32.1-481.el9_4.1, perl-Attribute-Handlers-1.01-481.el9_4.1, perl-AutoLoader-5.74-481.el9_4.1 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Fixed | RHSA-2025:13267 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:12056 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:11805, RHSA-2026:8096 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:11804 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2026:37070 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2026:50262 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:11545 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) | Fixed | RHSA-2026:37070 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2026:50262 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:11805 |
Not affected: 3 products
- Red Hat Discovery 2
- Red Hat Enterprise Linux AppStream E4S (v.8.8)
- Red Hat Enterprise Linux AppStream TUS (v.8.8)
Timeline
- 2026-10-02 Threatist record created from CVE-2025-40909
- 2026-10-03 Alias added: GHSA-jpf5-526x-c5hw
References
Other 5
- https://github.com/Perl/perl5/issues/23010
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226
- https://github.com/Perl/perl5/issues/10387
- https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads
- https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e
More Perl vulnerabilities
- TI-2021-05190 Code injection in ExifTool KEVCVSS 3.1HIGH 7.8
- TI-2022-24100 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead… CVSS 3.1CRITICAL 9.8
- TI-2012-05140 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl… CVSS 2.0HIGH 7.5
- TI-2018-12932 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
- TI-2018-12931 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
- TI-2018-05049 Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows… CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-40909 · CVE Program
- CVE-2025-40909 · NVD
- FIRST EPSS
- GHSA-jpf5-526x-c5hw · GitHub Advisory Database · CC BY 4.0
- CVE-2025-40909 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences