RRWO Linux::Statm::Tiny up to 0.700 on Perl Working Directory uncontrolled search path

Summaryinfo

A vulnerability marked as problematic has been reported in RRWO Linux::Statm::Tiny up to 0.700 on Perl. Affected by this vulnerability is an unknown functionality of the component Working Directory Handler. Performing a manipulation results in uncontrolled search path. This vulnerability was named CVE-2025-3051. The attack needs to be approached locally. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in RRWO Linux::Statm::Tiny up to 0.700 on Perl. This affects an unknown code of the component Working Directory Handler. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. Linux::Statm::Tiny uses Mite to produce the affected code section due to CVE-2025-30672

The advisory is shared at metacpan.org. This vulnerability is uniquely identified as CVE-2025-3051 since 03/31/2025. The exploitability is told to be difficult. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

Upgrading to version 0.0701 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• RRWO

Name

• Linux::Statm::Tiny

Version

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion