EUVD-2026-58117
GHSA-9pqq-8968-ccrw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
AC:H reflects the non-trivial file-placement precondition; C:H corrects the underrated confidentiality impact since arbitrary system() execution yields full process-level access.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename.
load_lexicon builds the catalog path by appending Messages/$lang.po to the directory holding Localizer.pm, where $lang is the language attribute, with no check that it names a bare locale tag. A value holding ../ segments walks out of the message directory, so any readable path with a .po suffix is loaded. While parsing the catalog, extract_header_msgstr takes the Plural-Forms: header, prefixes $ to the bare words nplurals, plural and n, and passes the rest verbatim into a string that is evaluated: the nplurals form evaluates the header expression immediately, and the plural_code form compiles it into a subroutine whose body runs when a plural message is localized. A header of nplurals=2; plural=(system('...'),0); therefore runs that command as the catalog loads. The evaluation inherits strict, so an expression that assigns to an undeclared variable fails to compile, while one built from calls alone does not.
An application that sets the language attribute from request data, an Accept-Language header or a locale parameter, and an attacker who can place a file with a .po suffix and chosen contents at a readable path, together give code execution as the application user. The message expansion path is not affected: expand_named substitutes only the placeholder names the caller supplies, and _mangle_value returns the value unchanged.
AnalysisAI
Remote code execution is achievable in Data::MuForm::Localizer for Perl (versions through 0.05) when an application passes user-supplied locale identifiers - such as an Accept-Language header or locale query parameter - directly to the load_lexicon function, and an attacker can also place a crafted .po file at a readable path on the server. The module constructs the catalog path by unsanitized interpolation of the language attribute, enabling directory traversal, then eval-executes the Plural-Forms header of the loaded catalog as live Perl code, giving the attacker arbitrary OS command execution as the application process user. No public exploit code is referenced in available sources and this CVE is not listed in CISA KEV; a vendor patch is available from CPANSec.
Technical ContextAI
Data::MuForm::Localizer is a Perl internationalization module distributed via CPAN under the Data-MuForm distribution (author GSHANK). The vulnerability is rooted in CWE-95 (Eval Injection) and combines two weaknesses in sequence. First, load_lexicon (Localizer.pm lines 56-63) builds the .po catalog path by directly interpolating the $lang attribute into a filename pattern (Messages/$lang.po relative to the directory containing Localizer.pm), with no validation that $lang is a well-formed locale tag. This permits path traversal via ../ sequences in the attribute value. Second, the catalog parser's extract_header_msgstr function (lines 381-428) processes the Plural-Forms header by prepending $ to the bare words nplurals, plural, and n and feeding the assembled string to Perl's eval: the nplurals expression evaluates immediately at catalog-load time, and the plural_code form is compiled into a subroutine whose body executes on every plural message expansion. A header of nplurals=2; plural=(system('...'),0); therefore executes an arbitrary shell command the moment the catalog is loaded. Perl's strict pragma is inherited by the eval context, which prevents some forms (undeclared variable assignment) but does not block call-based payloads such as system().
Affected ProductsAI
All versions of Data::MuForm::Localizer through and including 0.05 for Perl are affected, as documented by CPANSec and the oss-security advisory at https://seclists.org/oss-sec/2026/q3/484. The vulnerable source is Localizer.pm within the Data-MuForm CPAN distribution authored by GSHANK; the precise vulnerable lines are documented at https://metacpan.org/release/GSHANK/Data-MuForm-0.05/source/lib/Data/MuForm/Localizer.pm#L56-63 (path construction) and L381-428 (eval execution). No CPE string was included in the provided intelligence data; no other products or versions are identified as affected in the available sources.
RemediationAI
Apply the CPANSec patch directly available at https://security.metacpan.org/patches/D/Data-MuForm/0.05/CVE-2026-13048-r2.patch, which addresses both the unsanitized path construction in load_lexicon and the unsafe eval of the Plural-Forms header. No specific fixed CPAN release version number (e.g., Data-MuForm-0.06 or later) is confirmed in the provided references; operators should verify with the CPAN distribution maintainer or monitor the CPANSec advisory at https://seclists.org/oss-sec/2026/q3/484 for a tagged release. If immediate patching is not feasible, two compensating controls should be applied in combination: first, validate the language attribute against a strict allowlist of known locale tags (e.g., enforcing the pattern /^[a-z]{2}(_[A-Z]{2})?$/ before calling load_lexicon) to eliminate the traversal vector entirely - this directly blocks exploitation regardless of the eval issue; second, ensure the application process user has no write access to directories reachable via traversal from the message catalog path, reducing the attacker's ability to stage a malicious .po file. The first control is sufficient to block the traversal prerequisite; the second reduces the file-placement precondition but does not eliminate the underlying eval risk.
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today