PT-2025-14020 · Tobyink+2 · Sub::Handlesvia+1

Published 2025-04-01 · Updated 2025-04-01 · CVE-2025-30673

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.

If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.

Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2025-30673

Affected Products

Sub::Handlesvia

Libsub-Handlesvia-Perl

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2025-30673 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30673 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30673 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-30673 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-30673 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-30673 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-30673 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libsub-handlesvia-perl · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-30673 · Vendor Advisory
• https://lists.security.metacpan.org/cve-announce/msg/28383041 · Note
• https://t.me/cvedetector/21716 · Telegram Post
• https://t.me/cvetracker/20424 · Telegram Post
• https://twitter.com/CVEnew/status/1906977441391718660 · Twitter Post
• https://packages.debian.org/src:libsub-handlesvia-perl · Note
• https://blogs.perl.org/users/todd_rinaldo/2016/11/what-happened-to-dot-in-inc.html · Note