PT-2026-60744 · Burak · Gd::Securityimage

CVE-2026-13082 · Published 2026-07-17 · Updated 2026-07-17

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.

The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.

The built-in rand function is unsuitable for security applications because it is predictable and reversible.

Fix

Weakness Enumeration

CWE-804

CWE-338

Related Identifiers

CVE-2026-13082

Affected Products

Gd::Securityimage

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-13082 · Security Note
• https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch · Patch
• https://cve.org/CVERecord?id=CVE-2025-40916 · Security Note