Skip to content
Fencer Vulns
medium 5.9

CVE-2025-40909 json

Perl threads have a working directory race condition where file operations may target unintended paths

published 2025-05-30 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16506

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

Perl threads have a working directory race condition where file operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.

This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.

The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

Patch / fix

  • perl perl 5.41.13
  • perl Debian 12 5.36.0-7+deb12u3
  • perl Debian 14, Debian 13 5.40.1-5

debian advisories DEBIAN-CVE-2025-40909

  • perl Ubuntu 22.04 LTS 5.34.0-3ubuntu1.5
  • perl Ubuntu 24.04 LTS 5.38.2-3.2ubuntu0.2

ubuntu advisories UBUNTU-CVE-2025-40909

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl RHEL 8 4:5.32.1-474.module+el8.10.0+24099+8aa2f756
  • perl-B RHEL 8 1.80-474.module+el8.10.0+24099+8aa2f756
  • perl-if RHEL 8 0.60.800-474.module+el8.10.0+24099+8aa2f756
  • perl-IO RHEL 8 1.43-474.module+el8.10.0+24099+8aa2f756
  • perl-ph RHEL 8 5.32.1-474.module+el8.10.0+24099+8aa2f756
  • perl-Env RHEL 8 1.04-396.module+el8.10.0+21354+3ad137bb
  • perl-lib RHEL 8 0.65-474.module+el8.10.0+24099+8aa2f756
  • perl-mro RHEL 8 1.23-474.module+el8.10.0+24099+8aa2f756

red hat advisories RHSA-2026:50262RHSA-2026:37070RHSA-2026:8096RHSA-2025:12056RHSA-2025:11804RHSA-2025:11805

  • perl Linux Micro 6.1 5.38.2-slfo.1.1_2.1
  • perl Linux Micro 6.0 5.38.2-4.1
  • perl SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, SLE Module for Development Tools 15 SP7 +9 more 5.26.1-150300.17.20.1
  • perl SLES LTSS Extended Security 12 SP5 5.18.2-12.29.1

suse advisories SUSE-SU-2025:20532-1SUSE-SU-2025:20456-1SUSE-SU-2025:02051-1SUSE-SU-2025:02027-1

  • perl openSUSE Tumbleweed 5.40.2-3.1

opensuse advisories openSUSE-SU-2025:15258-1

  • perl AlmaLinux 8 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-B AlmaLinux 8 1.80-474.module_el8.10.0+4162+0aac7c4c
  • perl-if AlmaLinux 8 0.60.800-474.module_el8.10.0+4162+0aac7c4c
  • perl-IO AlmaLinux 8 1.43-474.module_el8.10.0+4162+0aac7c4c
  • perl-ph AlmaLinux 8 5.32.1-474.module_el8.10.0+4162+0aac7c4c
  • perl-Env AlmaLinux 8 1.04-396.module_el8.6.0+2766+8bf0b7ce
  • perl-lib AlmaLinux 8 0.65-474.module_el8.10.0+4162+0aac7c4c
  • perl-mro AlmaLinux 8 1.23-474.module_el8.10.0+4162+0aac7c4c

almalinux advisories ALSA-2026:8096ALSA-2025:11805

  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+882+2fa1e48f
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+878+f93dfff7
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+1616+0d20cc68
  • perl-URI Rocky Linux 8 1.76-5.module+el8.10.0+1616+0d20cc68
  • perl-URI Rocky Linux 8 1.76-5.module+el8.6.0+878+f93dfff7
  • perl-Carp Rocky Linux 8 1.50-439.module+el8.10.0+1616+0d20cc68
  • perl-Carp Rocky Linux 8 1.50-439.module+el8.6.0+878+f93dfff7
  • perl-CPAN Rocky Linux 8 2.28-5.module+el8.10.0+1616+0d20cc68

rocky linux advisories RLSA-2026:8096RLSA-2025:11804RLSA-2025:12056RLSA-2025:11805

  • perl CBL-Mariner 2.0 5.34.1-491
  • perl Azure Linux 3.0 5.38.2-509

azure linux advisories AZL-62067AZL-62069

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-40909 updated cvss 5.9

perl: Perl threads have a working directory race condition where file operations may target unintended paths

  • Red Hat Enterprise Linux 6 perl, perl-CGI, perl-core, perl-CPAN, perl-libs, perl-parent, +39 more Red Hat Enterprise Linux 7 perl, perl-core, perl-CPAN, perl-libs, perl-tests, perl-macros, +11 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Discovery 2 discovery 2.0.1-1754478727
    fixed: vendor fix RHSA-2025:13267
  • Red Hat Enterprise Linux AppStream (v. 8) perl 5.26.3-423.el8_10, perl-open 1.11-423.el8_10, perl-Test 1.30-423.el8_10, perl-Memoize 1.03-423.el8_10, perl-tests 5.26.3-423.el8_10, perl-utils 5.26.3-423.el8_10, +231 more
    fixed: vendor fix RHSA-2025:11805
  • Red Hat Enterprise Linux AppStream (v. 9) perl 5.32.1-481.1.el9_6, perl-B 1.80-481.1.el9_6, perl-IO 1.43-481.1.el9_6, perl-Tie 4.6-481.1.el9_6, perl-lib 0.65-481.1.el9_6, perl-mro 1.23-481.1.el9_6, +92 more
    fixed: vendor fix RHSA-2025:11804
  • Red Hat Enterprise Linux AppStream (v. 10) perl 5.40.2-512.2.el10_0, perl-B 1.89-512.2.el10_0, perl-IO 1.55-512.2.el10_0, perl-Tie 4.6-512.2.el10_0, perl-lib 0.65-512.2.el10_0, perl-mro 1.29-512.2.el10_0, +92 more
    fixed: vendor fix RHSA-2025:12056
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) perl-URI 1.76-5.module+el8.6.0+13324+628a2397, perl-CPAN 2.28-5.module+el8.6.0+13324+628a2397, perl 5.32.1-471.module+el8.6.0+24484+7827d5b5.1, perl-B 1.80-471.module+el8.6.0+24484+7827d5b5.1, perl-Env 1.04-396.module+el8.6.0+13324+628a2397, perl-Carp 1.50-439.module+el8.6.0+13324+628a2397, +213 more
    fixed: vendor fix RHSA-2026:37070
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) perl 5.32.1-472.module+el8.8.0+24404+b3ad2701.1, perl-libs 5.32.1-472.module+el8.8.0+24404+b3ad2701.1, perl-interpreter 5.32.1-472.module+el8.8.0+24404+b3ad2701.1
    fixed: vendor fix RHSA-2026:50262
show 5 more
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) perl 5.32.1-481.el9_4.1, perl-B 1.80-481.el9_4.1, perl-IO 1.43-481.el9_4.1, perl-Tie 4.6-481.el9_4.1, perl-lib 0.65-481.el9_4.1, perl-mro 1.23-481.el9_4.1, +92 more
    fixed: vendor fix RHSA-2025:11545
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) perl-URI 1.76-5.module+el8.6.0+13324+628a2397, perl-CPAN 2.28-5.module+el8.6.0+13324+628a2397, perl 5.32.1-471.module+el8.6.0+24484+7827d5b5.1, perl-B 1.80-471.module+el8.6.0+24484+7827d5b5.1, perl-Env 1.04-396.module+el8.6.0+13324+628a2397, perl-Carp 1.50-439.module+el8.6.0+13324+628a2397, +213 more
    fixed: vendor fix RHSA-2026:37070
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) perl 5.32.1-472.module+el8.8.0+24404+b3ad2701.1, perl-libs 5.32.1-472.module+el8.8.0+24404+b3ad2701.1, perl-interpreter 5.32.1-472.module+el8.8.0+24404+b3ad2701.1
    fixed: vendor fix RHSA-2026:50262
  • Red Hat Enterprise Linux BaseOS (v. 8) perl 5.26.3-423.el8_10, perl-IO 1.38-423.el8_10, perl-Errno 1.28-423.el8_10, perl-libs 5.26.3-423.el8_10, perl-IO-Zlib 1.10-423.el8_10, perl-macros 5.26.3-423.el8_10, +2 more
    fixed: vendor fix RHSA-2025:11805
  • Red Hat Discovery 2 discovery 2.0.1-1754485705 Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-URI 1.76-5.module+el8.6.0+13324+628a2397, perl-CPAN 2.28-5.module+el8.6.0+13324+628a2397, perl-B 1.80-472.module+el8.8.0+24404+b3ad2701.1, perl-Env 1.04-396.module+el8.6.0+13324+628a2397, perl-Carp 1.50-439.module+el8.6.0+13324+628a2397, perl-Digest 1.20-1.module+el8.6.0+13324+628a2397, +210 more Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-URI 1.76-5.module+el8.6.0+13324+628a2397, perl-CPAN 2.28-5.module+el8.6.0+13324+628a2397, perl-B 1.80-472.module+el8.8.0+24404+b3ad2701.1, perl-Env 1.04-396.module+el8.6.0+13324+628a2397, perl-Carp 1.50-439.module+el8.6.0+13324+628a2397, perl-Digest 1.20-1.module+el8.6.0+13324+628a2397, +210 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • openwall.com https://www.openwall.com/lists/oss-security/2025/05/22/2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 3.1 5.9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

  • perl perl

Classification

Weakness
  • CWE-689 Permission Race Condition During Resource Copy
  • CWE-426 Untrusted Search Path

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.