01 Record

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

HighPUBLISHEDCNA: CPANSec

Base score8.2 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

View raw JSON CVE Program record

02 Description

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

03 Metadata

Published: 2026-08-13 16:28Z1 DAY AGO
Last updated: 2026-08-14 11:31Z7 HR AGO
Reserved: 2026-06-23
Assigning CNA: CPANSec
Record state: PUBLISHED
Severity: High (CVSS 8.2)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses: CWE-22 CWE-95
SSVC decision: ExploitationnoneAutomatableyesTechnical Impactpartial
Data version: 5.2
Document digest: 30bd97e62d5fe2df22aa540c58dd1a528efa36585ec42192365f6f7ac2f27849

04 Affected products

No products listed

This record names no affected vendor or product. That is common for reserved identifiers and for records whose CNA published only a narrative description.

05 References

security.metacpan.orghttps://security.metacpan.org/patches/D/Data-MuForm/0.05/CVE-2026-13048-r2.patchpatch
metacpan.orghttps://metacpan.org/release/GSHANK/Data-MuForm-0.05/source/lib/Data/MuForm/Localizer.pm#L56-63
metacpan.orghttps://metacpan.org/release/GSHANK/Data-MuForm-0.05/source/lib/Data/MuForm/Localizer.pm#L381-428
www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/08/13/10