IO::Uncompress::Unzip CVE-2025-15649

The CVSS attack vector is AV:L (local), meaning the attacker must be able to supply a file that is processed by a locally running Perl application using IO::Uncompress::Unzip. This covers scenarios including: local users placing files in watched directories, remote users uploading files through an application that subsequently processes them locally, or any pipeline where untrusted ZIP data reaches the module. Exploitation is limited to causing an uncaught exception in the parsing process (availability disruption only; no code execution, no data exfiltration). Conditions required: target system must run Perl with IO-Compress below 2.215, and the application must invoke IO::Uncompress::Unzip->new() against attacker-controlled input without its own outer eval guard. Limiting factors: local attack vector reduces opportunistic remote exploitation; low CVSS privilege requirement (PR:L) is consistent with any user who can write or deliver files; no authentication requirement is imposed by the module itself, though the application layer may enforce one.

The CVSS 3.1 base score of 5.5 (Medium) is consistent with the technical impact: AV:L requires an attacker to be able to supply a file processed on the local system; AC:L and PR:L reflect that no elevated privileges are needed beyond whatever access allows file placement or selection; S:U and C:N/I:N/A:H confirm the impact is limited to crashing the processing application with no confidentiality or integrity consequences. EPSS at 0.02% (6th percentile) aligns with the low exploitability - the vulnerability requires crafting a malformed ZIP and having it processed, making opportunistic mass exploitation implausible. There is no CISA KEV listing and no public proof-of-concept code. The 'Information Disclosure' tag in the ENISA record appears inconsistent with both the CVSS impact vector (A:H only) and the technical description; real-world impact is strictly availability disruption of the parsing process. The primary realistic concern is for Perl applications that unattended-process ZIP archives from untrusted sources (batch pipelines, file upload handlers), where an uncaught exception could silently crash a worker without an operator-visible error. Callers that rely on $UnzipError being populated on failure may mishandle the exception as an untrapped crash rather than a recoverable parse error, potentially surfacing stack traces or halting daemons.

An attacker crafts a ZIP archive where the local-file-header date field encodes an invalid value such as month 13 or hour 25, then causes a Perl application using IO::Uncompress::Unzip (version < 2.215) to process the file - for example, by uploading it to a batch processing queue, a file-import API endpoint, or placing it in a directory scanned by a local daemon. When the application calls IO::Uncompress::Unzip->new($file), timelocal() dies with an out-of-range error, the exception propagates unhandled, and the worker process terminates or enters an error state, disrupting ZIP processing availability. No public proof-of-concept has been identified, but the commit diff and GitHub issue at https://github.com/pmqs/IO-Compress/issues/65 provide sufficient detail to construct a malformed archive trivially.