PT-2025-14019 · Rrwo · Linux::Statm::Tiny

Published 2025-04-01 · Updated 2025-04-01 · CVE-2025-3051

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.

If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.

Linux::Statm::Tiny uses Mite to produce the affected code section due to CVE-2025-30672

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-3051

Affected Products

Linux::Statm::Tiny

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-3051 · Security Note
• https://twitter.com/CVEnew/status/1906977440565502246 · Twitter Post
• https://t.me/cvedetector/21713 · Telegram Post
• https://metacpan.org/release/RRWO/Linux-Statm-Tiny-0.0701/changes · Note
• https://metacpan.org/release/RRWO/Linux-Statm-Tiny-0.0700/source/lib/Linux/Statm/Tiny/Mite.pm#L82 · Note
• https://t.me/cvetracker/20434 · Telegram Post
• https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html · Note