CVE-2025-30673

EUVD-2025-9134
Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.

If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.

Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA-ADPADP
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 67%
Debian logo
Debian Releases
Debian Product
Codename
libsub-handlesvia-perl
bookworm
0.050000-1+deb12u1
fixed
bullseye
0.016-1
not-affected
forky
0.052000-1
fixed
sid
0.052000-1
fixed
trixie
0.050002-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libsub-handlesvia-perl
focal
dne
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
needs-triage