CVE-2010-2253: Gisle Aas Libwww-Perl

Medium severity, CVSS 6.8. EPSS: 3.3% chance of exploitation in the next 30 days.

lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.

Affected products

• Gisle Aas Libwww-Perl: version 0.01 only; version 0.02 only; version 0.03 only; version 0.04 only; version 5.00 only; version 5.01 only; …
• Search.cpan Libwww-Perl: up to and including 5.834; version 5.40_01 only

Published 2010-07-06. Last modified 2026-06-16.