PT-2026-8386 · Maypole · Maypole

Robert Rothenberg · Published 2026-02-16 · Updated 2026-03-10 · CVE-2025-15578

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maypole versions 2.10 through 2.13

Description The Maypole Perl framework improperly generates session IDs. The session ID is created using the system time obtained from HTTP response headers, the rand() function, and the process ID (PID). This method of session ID generation is considered insecure.

Recommendations Update Maypole to a version newer than 2.13.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

CVE-2025-15578

Affected Products

Maypole

References · 8

• https://osv.dev/vulnerability/CVE-2025-15578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15578 · Security Note
• https://t.me/cveNotify/154916 · Telegram Post
• https://twitter.com/CVEnew/status/2023532142828065077 · Twitter Post
• https://t.me/CVEtracker/44853 · Telegram Post
• https://t.me/cveNotify/152134 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2023531602374992196 · Twitter Post
• https://metacpan.org/dist/Maypole/source/lib/Maypole/Session.pm#L43 · Note