{"id":"CVE-2025-40909","summary":"Perl threads have a working directory race condition where file operations may target unintended paths","details":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6","modified":"2026-08-18T17:52:52.158878Z","published":"2025-05-30T12:20:11.237Z","related":["ALSA-2025:11805","ALSA-2026:8096","SUSE-SU-2025:02027-1","SUSE-SU-2025:02051-1","SUSE-SU-2025:20456-1","SUSE-SU-2025:20532-1","openSUSE-SU-2025:15258-1"],"database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-426","CWE-689"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40909.json"},"references":[{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/53"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/54"},{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Sep/55"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/23/1"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/05/30/4"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/02/2"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/02/5"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/02/6"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/02/7"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/06/03/1"},{"type":"WEB","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"},{"type":"WEB","url":"https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40909.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909"},{"type":"REPORT","url":"https://github.com/Perl/perl5/issues/10387"},{"type":"REPORT","url":"https://github.com/Perl/perl5/issues/23010"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch"},{"type":"PACKAGE","url":"https://github.com/perl/perl5"},{"type":"EVIDENCE","url":"https://www.openwall.com/lists/oss-security/2025/05/22/2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/perl/perl5","events":[{"introduced":"5bc1001b08a9ab20cf55683d2a0b5f53d4ad2c2b"},{"fixed":"11a11ecf4bea72b17d250cfb43c897be1341861e"},{"fixed":"918bfff86ca8d6d4e4ec5b30994451e0bd74aba9"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"5.13.6"},{"fixed":"5.41.13"}]}}],"versions":["v5.41.12","v5.41.11","v5.41.10","v5.41.9","v5.41.8","v5.41.7","v5.41.5","v5.41.4","v5.41.3","v5.40.0","v5.41.2","v5.41.1","v5.41.0","v5.40.0-RC2","v5.40.0-RC1","v5.39.8","v5.39.7","v5.39.5","v5.39.4","v5.38.0","v5.39.3","v5.39.1","v5.39.0","v5.38.0-RC2","v5.38.0-RC1","v5.37.11","v5.37.10","v5.37.9","v5.37.7","v5.37.6","v5.37.5","v5.37.4","v5.37.3","v5.37.2","v5.37.1","v5.36.0","v5.37.0","v5.36.0-RC3","v5.35.11","v5.35.10","v5.34.0","v5.35.9","v5.35.8","v5.35.6","v5.35.5","v5.35.3","v5.35.0","v5.34.0-RC2","v5.34.0-RC1","v5.33.9","v5.33.8","v5.33.7","v5.32.0","v5.33.4","v5.33.3","v5.33.2","v5.33.1","v5.33.0","v5.32.0-RC1","v5.31.11","v5.31.7","v5.31.5","v5.30.0","v5.31.4","v5.31.3","v5.31.2","v5.31.1","v5.31.0","v5.30.0-RC2","v5.30.0-RC1","v5.29.10","v5.29.9","v5.29.8","v5.29.7","v5.29.6","v5.29.5","v5.28.0","v5.29.1","v5.29.0","v5.28.0-RC4","v5.28.0-RC3","v5.28.0-RC2","v5.28.0-RC1","v5.27.11","v5.27.10","v5.27.8","v5.27.7","v5.27.6","v5.27.5","v5.27.3","v5.26.0","v5.27.0","v5.26.0-RC2","v5.25.11","v5.25.9","v5.25.7","v5.25.5","v5.25.4","v5.25.3","v5.24.0","v5.25.2","v5.25.0","v5.24.0-RC5","v5.24.0-RC4","v5.24.0-RC3","v5.24.0-RC2","v5.24.0-RC1","v5.23.7","v5.23.6","v5.23.4","v5.23.3","if-0.0605","v5.23.2","v5.23.1","v5.23.0","v5.22.0","v5.22.0-RC2","v5.22.0-RC1","v5.21.11","if-0.0604","v5.21.10","v5.21.9","v5.21.8","v5.21.6","v5.21.5","v5.21.4","v5.21.1","v5.21.0","v5.20.0","v5.20.0-RC1","v5.19.11","v5.19.7","v5.19.5","v5.19.3","v5.19.2","if-0.0603","v5.19.1","v5.18.0","v5.19.0","v5.18.0-RC4","v5.18.0-RC3","v5.18.0-RC2","v5.18.0-RC1","v5.17.9","v5.17.8","v5.17.7.0","v5.17.7","v5.17.6","v5.17.4","v5.17.2","v5.17.0","v5.16.0","v5.16.0-RC2","v5.16.0-RC1","v5.15.9","v5.15.5","v5.15.4","v5.15.3","v5.15.2","v5.15.1","v5.15.0","v5.14.0","v5.14.0-RC3","v5.14.0-RC2","v5.14.0-RC1","v5.13.11","v5.13.10","v5.13.9","v5.13.8","v5.13.7","v5.13.6"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40909.json","vanir_signatures_modified":"2026-08-18T17:52:52Z","vanir_signatures":[{"source":"https://github.com/perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9","target":{"file":"sv.c"},"deprecated":false,"digest":{"line_hashes":["134989881791484765225454295100888486938","307762351235177742618874279934252071339","280784363888831605331937931425797945453","266415500834560312804770478725285892410","168571006781411773793574523190511095115","44419617296205940517561654539728461875","313381937425225159106745391568724088200","112751932798179804637073209610012606519","104316939881430240765188332374744520210","6666723381872329224408230766340312533","264896245563241020398357574314421323781","88237496934789395080909596529469598413","73572078612416082274581877579360157407","63764881724391626650629905080692011501","313912212988895220527869575011389481101","48402561394206642641757265593067345793","206346663043440290754326837868978067607","192598271227925117478174663463399299808","127949726812717182357408022152527318674","310778379926484368699267701024600746036","187032941782560926031677404963079997481","48163905643376189135053436582103786151","169899785835388036861456233237629282982","63189568953478706060541314249057741313","128630491978655341332429076478157500551","111456226701959555350450897095101453025","100074874969717106999652408286892095092","99361758982423425760361062575325853352","223307511828456364698267817806185172902","286976545792422583028405518981265571374","74760733419598702284823481804552664464","217368482471608510087982229806635284585","251160461044108952013027661369970711438","131666541796340747512511278784666106714","335122557764594640103563123825458724463","296886904577464420256263857686185596383","24133131573386123190444987619731832079","244787624947565803229344092673277837182","295537587127988667561590179489290981128","165154069885591547489617904326643429700","242141158522400262192847830143237176291","289802151583941083142928195154555517364","192675234785650631767227888885765960721","67629499097733702028920643375740053683","73066694710548787734517898996151700290","302049475943636908707721460178451013196","17252976370351002263757390283681063454","45084754974679473338319900133796734046","224309270600081335802803330395633106684","336390951612205493687436673653501030227","165739606322193962004516588743938127675","242783520639934835081870154429138894941","127780945955950790638035405584626054017","121085637768858710249549333997974105108","308111053058734644735903452184557604125","5702662798046728584313952421750973160","316679690828017718741021620436901486731","300938082853795118822762227327458576617","77740687308573715517607999100870794485","303588880441522416286792930712847582836","75407180318704451699303769443305508093","173441149880374656384137151503784482446","228130603545580167826059575595231157140","281470844731957467504792345368393091837","184170649228360192411769286104511327022","301960110873300749667315520716797268873","217089828942714629305626512483300529215","109945299454953160178434225138364549758","235178788719035438250282608489151064997"],"threshold":0.9},"id":"CVE-2025-40909-6864ca17","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2025-40909-6ba9514a","signature_type":"Line","signature_version":"v1","source":"https://github.com/perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","target":{"file":"sv.c"},"deprecated":false,"digest":{"line_hashes":["22034570276518843404193385371009359011","247772817705386320678187213730606800195","299176583276109461925546512587074458878","147811562175043980714330410304533921428","108081159071924406914849182561610799254","179410232723938575327882954132113718823","295081009194112414813087408725233223331","288112809098045777714190879625246982720"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}