Lack of data validation - Path Traversal In libwww-perl
Description
lwp-download in libwww-perl before 5.835 does not reject downloads to filenames that begin with a . (dot) character, which allows remote servers to create or overwrite files via (1) a 3xx redirect to a URL with a crafted filename or (2) a Content-Disposition header that suggests a crafted filename, and possibly execute arbitrary code as a consequence of writing to a dotfile in a home directory.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 14 | 5.835-1 | ||
debian 11 | 5.835-1 | ||
debian 12 | 5.835-1 | ||
debian 13 | 5.835-1 | ||
 rpm rhel6 | - | - | |
rpm rhel5 | - | - |
Aliases
1. 2. 3. 4. 5.