PT-2025-14018 · Mite · Mite

Published 2025-04-01 · Updated 2025-05-14 · CVE-2025-30672

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mite for Perl versions prior to 0.013000

Description The issue allows for code injection via @INC path manipulation. If an attacker can place a malicious file in the current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. This affects the Mite distribution itself and other distributions that contain code generated by Mite.

Recommendations For versions prior to 0.013000, update to version 0.013000 or later to resolve the issue. As a temporary workaround, consider restricting access to the current working directory to minimize the risk of exploitation. Avoid using the @INC path in sensitive operations until the issue is resolved.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-30672

Affected Products

Mite

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-30672 · Security Note
• https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html · Note
• https://twitter.com/fre3dm4n/status/1922639538146386195 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1906898620223209632 · Twitter Post
• https://t.me/cvetracker/20434 · Telegram Post
• https://metacpan.org/release/TOBYINK/Mite-0.013000/changes · Note
• https://t.me/cvetracker/20424 · Telegram Post
• https://t.me/cvetracker/20423 · Telegram Post
• https://wiki.gentoo.org/wiki/Project:Perl/Dot-In-INC-Removal · Note
• https://t.me/cvedetector/21713 · Telegram Post
• https://perldoc.perl.org/perlrun#PERL_USE_UNSAFE_INC · Note
• https://twitter.com/CVEnew/status/1906977442205413856 · Twitter Post
• https://t.me/cvedetector/21716 · Telegram Post
• https://t.me/cvedetector/21697 · Telegram Post
• https://t.me/cvenotify/117139 · Telegram Post