CVE-2025-30673: Tobyink Sub::handlesvia

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code execution. Sub::HandlesVia uses Mite to produce the affected code section due to CVE-2025-30672

Affected products

• Tobyink Sub::handlesvia: before 0.050002 (fixed in 0.050002)

Published 2025-04-01. Last modified 2026-06-17.