CVE-2025-3051 Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directory
An attacker can execute arbitrary code by placing a malicious file in the current working directory, which the library loads instead of the intended module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-3051?
CVE-2025-3051 is a medium-severity code injection vulnerability in RRWO Linux::Statm::Tiny, published on 1 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238.
If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution.
Linux::Statm::Tiny uses Mite to produce the affected code section due to CVE-2025-30672
Weakness: CWE-427
Which versions are affected by CVE-2025-3051?
How do I fix CVE-2025-3051?
No fix has been published for CVE-2025-3051 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-3051 being exploited?
There is no known exploitation of CVE-2025-3051 in the wild and no public exploit code.
Sources
Also known as GHSA-q2hm-mp4x-64qg.