Description

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename. load_lexicon builds the catalog path by appending `Messages/$lang.po` to the directory holding Localizer.pm, where $lang is the language attribute, with no check that it names a bare locale tag. A value holding `../` segments walks out of the message directory, so any readable path with a `.po` suffix is loaded. While parsing the catalog, extract_header_msgstr takes the `Plural-Forms:` header, prefixes `$` to the bare words nplurals, plural and n, and passes the rest verbatim into a string that is evaluated: the nplurals form evaluates the header expression immediately, and the plural_code form compiles it into a subroutine whose body runs when a plural message is localized. A header of `nplurals=2; plural=(system('...'),0);` therefore runs that command as the catalog loads. The evaluation inherits strict, so an expression that assigns to an undeclared variable fails to compile, while one built from calls alone does not. An application that sets the language attribute from request data, an Accept-Language header or a locale parameter, and an attacker who can place a file with a `.po` suffix and chosen contents at a readable path, together give code execution as the application user. The message expansion path is not affected: expand_named substitutes only the placeholder names the caller supplies, and _mangle_value returns the value unchanged.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T17:17:19.397Z",
  "pubdate": "2026-08-13T17:17:19.397Z",
  "executiveSummary": "Data::MuForm::Localizer versions through 0.05 suffer from an arbitrary code execution vulnerability involving path traversal and insecure evaluation of message catalog headers. The vulnerability resides in the load_lexicon function, which improperly sanitizes the language attribute when constructing message catalog file paths. This flaw allows attackers to traverse directories and load arbitrary files possessing a .po suffix. Subsequently, the extract_header_msgstr routine unsafely processes the Plural-Forms header, passing extracted expressions directly into a dynamic string evaluation mechanism. Exploitation of this flaw grants an attacker the ability to execute arbitrary system commands under the privileges of the application user. Prerequisites for successful exploitation include an application that dynamically sets the language attribute from unverified request data, such as an Accept-Language header or locale parameter, combined with the attacker's ability to place a crafted .po file at a readable path on the filesystem. The impact is severe, resulting in complete compromise of the application user context and potential system-wide repercussions depending on application privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation and dangerous dynamic code evaluation within Data::MuForm::Localizer. The vulnerable component is the load_lexicon function, which builds the message catalog path by appending Messages/$lang.po to the directory containing Localizer.pm, where $lang is derived from the language attribute. Because the implementation lacks checks to ensure $lang is a bare locale tag, supplying path traversal sequences such as ../ allows the path resolution to walk outside the intended message directory. Consequently, any readable file on the filesystem possessing a .po suffix can be loaded as a message catalog.\nDuring the parsing of the maliciously loaded catalog, the extract_header_msgstr function isolates the Plural-Forms header. It prefixes $ to the bare words nplurals, plural, and n, and concatenates the remainder of the header verbatim into a string that is subsequently evaluated via Perl's evaluation mechanisms. The nplurals form immediately evaluates the header expression upon loading, while the plural_code form compiles the expression into a subroutine whose body executes whenever a plural message is localized. Because the evaluation inherits strict constraints, expressions assigning to undeclared variables fail compilation, but expressions constructed strictly from function calls execute successfully. For example, a crafted header of nplurals=2; plural=(system('...'),0); forces the execution of the specified system command synchronously as the catalog is loaded.\nThe attack flow proceeds in a sequential manner. First, an attacker establishes a readable .po file containing a malicious Plural-Forms header on the target filesystem at a known or predictable path. Second, the attacker interacts with the web application, supplying a specially crafted language attribute via request data, an Accept-Language header, or a locale parameter. Third, the application passes this input to Data::MuForm::Localizer, triggering the load_lexicon function to traverse the directory structure and ingest the attacker-supplied .po file. Fourth, extract_header_msgstr parses the file and submits the malicious header to dynamic code evaluation. Finally, the payload executes with the permissions of the application user, achieving arbitrary code execution without requiring authentication, depending entirely on how exposed the application entry points are to untrusted locale inputs."
}