CVE-2013-4407: HTTP-Body Project HTTP-Body

Medium severity, CVSS 6.8. EPSS: 2.9% chance of exploitation in the next 30 days.

HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

Affected products

• HTTP-Body Project HTTP-Body: up to and including 1.17; version 0.01 only; version 0.2 only; version 0.03 only; version 0.4 only; version 0.5 only; …

Published 2013-11-23. Last modified 2026-06-16.