CVE-2025-40909

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-40909
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40909.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-40909
Downstream
Related
Published
2025-05-30T12:20:11.237Z
Modified
2026-07-15T15:53:46.611369Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Perl threads have a working directory race condition where file operations may target unintended paths
Details

Perl threads have a working directory race condition where file operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.

This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.

The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

Database specific 
{
    "cwe_ids": [
        "CWE-426",
        "CWE-689"
    ],
    "cna_assigner": "CPANSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40909.json"
}
References

Affected packages

Git / github.com/perl/perl5

Affected ranges

Type
GIT
Repo
https://github.com/perl/perl5
Events
Introduced
5bc1001b08a9ab20cf55683d2a0b5f53d4ad2c2b
Fixed
11a11ecf4bea72b17d250cfb43c897be1341861e
Fixed
918bfff86ca8d6d4e4ec5b30994451e0bd74aba9
Database specific 
{
    "extracted_events": [
        {
            "introduced": "5.13.6"
        },
        {
            "fixed": "5.41.13"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

if-0.*
if-0.0603
if-0.0604
if-0.0605
v5.*
v5.13.10
v5.13.11
v5.13.6
v5.13.7
v5.13.8
v5.13.9
v5.14.0
v5.14.0-RC1
v5.14.0-RC2
v5.14.0-RC3
v5.15.0
v5.15.1
v5.15.2
v5.15.3
v5.15.4
v5.15.5
v5.15.9
v5.16.0
v5.16.0-RC1
v5.16.0-RC2
v5.17.0
v5.17.2
v5.17.4
v5.17.6
v5.17.7
v5.17.7.0
v5.17.8
v5.17.9
v5.18.0
v5.18.0-RC1
v5.18.0-RC2
v5.18.0-RC3
v5.18.0-RC4
v5.19.0
v5.19.1
v5.19.11
v5.19.2
v5.19.3
v5.19.5
v5.19.7
v5.20.0
v5.20.0-RC1
v5.21.0
v5.21.1
v5.21.10
v5.21.11
v5.21.4
v5.21.5
v5.21.6
v5.21.8
v5.21.9
v5.22.0
v5.22.0-RC1
v5.22.0-RC2
v5.23.0
v5.23.1
v5.23.2
v5.23.3
v5.23.4
v5.23.6
v5.23.7
v5.24.0
v5.24.0-RC1
v5.24.0-RC2
v5.24.0-RC3
v5.24.0-RC4
v5.24.0-RC5
v5.25.0
v5.25.11
v5.25.2
v5.25.3
v5.25.4
v5.25.5
v5.25.7
v5.25.9
v5.26.0
v5.26.0-RC2
v5.27.0
v5.27.10
v5.27.11
v5.27.3
v5.27.5
v5.27.6
v5.27.7
v5.27.8
v5.28.0
v5.28.0-RC1
v5.28.0-RC2
v5.28.0-RC3
v5.28.0-RC4
v5.29.0
v5.29.1
v5.29.10
v5.29.5
v5.29.6
v5.29.7
v5.29.8
v5.29.9
v5.30.0
v5.30.0-RC1
v5.30.0-RC2
v5.31.0
v5.31.1
v5.31.11
v5.31.2
v5.31.3
v5.31.4
v5.31.5
v5.31.7
v5.32.0
v5.32.0-RC1
v5.33.0
v5.33.1
v5.33.2
v5.33.3
v5.33.4
v5.33.7
v5.33.8
v5.33.9
v5.34.0
v5.34.0-RC1
v5.34.0-RC2
v5.35.0
v5.35.10
v5.35.11
v5.35.3
v5.35.5
v5.35.6
v5.35.8
v5.35.9
v5.36.0
v5.36.0-RC3
v5.37.0
v5.37.1
v5.37.10
v5.37.11
v5.37.2
v5.37.3
v5.37.4
v5.37.5
v5.37.6
v5.37.7
v5.37.9
v5.38.0
v5.38.0-RC1
v5.38.0-RC2
v5.39.0
v5.39.1
v5.39.3
v5.39.4
v5.39.5
v5.39.7
v5.39.8
v5.40.0
v5.40.0-RC1
v5.40.0-RC2
v5.41.0
v5.41.1
v5.41.10
v5.41.11
v5.41.12
v5.41.2
v5.41.3
v5.41.4
v5.41.5
v5.41.7
v5.41.8
v5.41.9

Database specific

vanir_signatures_modified 
"2026-07-15T15:53:46Z"
vanir_signatures 
[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "134989881791484765225454295100888486938",
                "307762351235177742618874279934252071339",
                "280784363888831605331937931425797945453",
                "266415500834560312804770478725285892410",
                "168571006781411773793574523190511095115",
                "44419617296205940517561654539728461875",
                "313381937425225159106745391568724088200",
                "112751932798179804637073209610012606519",
                "104316939881430240765188332374744520210",
                "6666723381872329224408230766340312533",
                "264896245563241020398357574314421323781",
                "88237496934789395080909596529469598413",
                "73572078612416082274581877579360157407",
                "63764881724391626650629905080692011501",
                "313912212988895220527869575011389481101",
                "48402561394206642641757265593067345793",
                "206346663043440290754326837868978067607",
                "192598271227925117478174663463399299808",
                "127949726812717182357408022152527318674",
                "310778379926484368699267701024600746036",
                "187032941782560926031677404963079997481",
                "48163905643376189135053436582103786151",
                "169899785835388036861456233237629282982",
                "63189568953478706060541314249057741313",
                "128630491978655341332429076478157500551",
                "111456226701959555350450897095101453025",
                "100074874969717106999652408286892095092",
                "99361758982423425760361062575325853352",
                "223307511828456364698267817806185172902",
                "286976545792422583028405518981265571374",
                "74760733419598702284823481804552664464",
                "217368482471608510087982229806635284585",
                "251160461044108952013027661369970711438",
                "131666541796340747512511278784666106714",
                "335122557764594640103563123825458724463",
                "296886904577464420256263857686185596383",
                "24133131573386123190444987619731832079",
                "244787624947565803229344092673277837182",
                "295537587127988667561590179489290981128",
                "165154069885591547489617904326643429700",
                "242141158522400262192847830143237176291",
                "289802151583941083142928195154555517364",
                "192675234785650631767227888885765960721",
                "67629499097733702028920643375740053683",
                "73066694710548787734517898996151700290",
                "302049475943636908707721460178451013196",
                "17252976370351002263757390283681063454",
                "45084754974679473338319900133796734046",
                "224309270600081335802803330395633106684",
                "336390951612205493687436673653501030227",
                "165739606322193962004516588743938127675",
                "242783520639934835081870154429138894941",
                "127780945955950790638035405584626054017",
                "121085637768858710249549333997974105108",
                "308111053058734644735903452184557604125",
                "5702662798046728584313952421750973160",
                "316679690828017718741021620436901486731",
                "300938082853795118822762227327458576617",
                "77740687308573715517607999100870794485",
                "303588880441522416286792930712847582836",
                "75407180318704451699303769443305508093",
                "173441149880374656384137151503784482446",
                "228130603545580167826059575595231157140",
                "281470844731957467504792345368393091837",
                "184170649228360192411769286104511327022",
                "301960110873300749667315520716797268873",
                "217089828942714629305626512483300529215",
                "109945299454953160178434225138364549758",
                "235178788719035438250282608489151064997"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9",
        "id": "CVE-2025-40909-6864ca17",
        "target": {
            "file": "sv.c"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "22034570276518843404193385371009359011",
                "247772817705386320678187213730606800195",
                "299176583276109461925546512587074458878",
                "147811562175043980714330410304533921428",
                "108081159071924406914849182561610799254",
                "179410232723938575327882954132113718823",
                "295081009194112414813087408725233223331",
                "288112809098045777714190879625246982720"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e",
        "id": "CVE-2025-40909-6ba9514a",
        "target": {
            "file": "sv.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-40909.json"