CVE-2025-15649

Name of the Vulnerable Software and Affected Versions IO::Uncompress::Unzip versions prior to 2.215

Description An uncaught exception occurs when parsing a zip header containing a malformed DOS date. The function dosToUnixTime() decodes the last-modification date field of the local-file-header and invokes Time::Local::timelocal() without an eval guard. If the date field decodes to an out-of-range month, day, or hour, timelocal() fails, causing the exception to propagate through IO::Uncompress::Unzip->new($file) instead of returning the expected undef and $UnzipError.

Recommendations Update to version 2.215 or later.