Medium severity · published May 30, 2025
CVE-2025-40909
Perl threads have a working directory race condition where file operations may target unintended paths
5.9
CVSS
0.5%
EPSS
No
On KEV
Description
Perl threads have a working directory race condition where file operations may target unintended paths.
If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.
This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.
The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PE
perl · perl
5.13.6 before 5.41.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40909
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40909
bugs.debian.org
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226
github.com
https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e
github.com
https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch
github.com
https://github.com/Perl/perl5/issues/10387
github.com
https://github.com/Perl/perl5/issues/23010
perldoc.perl.org
https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads
More from perl
9.8
CVE-2026-8376
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
9.8
CVE-2026-4176
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
9.8
CVE-2022-48522
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation
9.8
CVE-2018-18314
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations
9.8
CVE-2018-18311
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations