6 matches found
CVE-2026-13048
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2026-13048
Data::MuForm::Localizer for Perl (through v0.05) is vulnerable. load_lexicon constructs catalog paths using Messages/$lang.po without validating bare locale tags, enabling ../ path traversal and loading of arbitrary .po files. While parsing, the code evaluates header-derived content (Plural-Forms...
CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
CVE-2026-13048
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
EUVD-2026-58117
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...
PT-2026-71694
Name of the Vulnerable Software and Affected Versions Data::MuForm::Localizer versions prior to 0.06 Description Remote code execution is possible because the load lexicon function interpolates the language attribute into the catalog filename without validating that it is a bare locale tag. An...