CVE-2026-13082

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13082
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13082.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13082
Downstream
Published
2026-07-17T12:54:07.177Z
Modified
2026-07-19T03:46:28.095876085Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
Details

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.

The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.

The built-in rand function is unsuitable for security applications because it is predictable and reversible.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13082.json",
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-338",
        "CWE-804"
    ]
}
References

Affected packages

Git / github.com/burak/cpan-gd-securityimage

Affected ranges

Type
GIT
Repo
https://github.com/burak/cpan-gd-securityimage
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1257deef621d94fe6919b33e21f5e89ef895a2f6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.75"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*
v0.70
v1.*
v1.68
v1.73
v1.74
v1.75

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13082.json"