Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade perl | Jun 5, 2017 | Jun 1, 2017 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Gentoo Linux | — | Upgrade virtual/perl-File-Path.Upgrade dev-lang/perl.Upgrade perl-core/File-Path. | Oct 30, 2017 | Jun 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Sep 16, 2021 | Jun 1, 2017 |
| Huawei Euleros 2_0_sp3 | — | — | Apr 30, 2021 | Jun 1, 2017 |
| Huawei Euleros 2_0_sp5 | — | — | Nov 19, 2019 | Jun 1, 2017 |
| Oracle Solaris | — | Upgrade runtime/perl-526 to version 5.26.3-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/perl-522 to version 5.22.1.1-11.4.6.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Jun 1, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 2, 2017 |
| Suse | — | Upgrade perl-32bitUpgrade perl-base-32bitUpgrade perl-x86Upgrade perl-docUpgrade perlUpgrade perl-File-PathUpgrade perl-baseUpgrade perl-Module-BuildUpgrade perl-Test-Simple | Nov 8, 2017 | Jun 1, 2017 |
| Ubuntu | — | Upgrade perl | Apr 25, 2018 | Jun 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub