CVE-2026-13048

Name of the Vulnerable Software and Affected Versions Data::MuForm::Localizer versions prior to 0.06

Description Remote code execution is possible because the load lexicon() function interpolates the language attribute into the catalog filename without validating that it is a bare locale tag. An attacker can use ../ segments in the language attribute to traverse directories and load any readable file with a .po suffix. During catalog parsing, the extract header msgstr() function processes the Plural-Forms: header by prefixing $ to the words nplurals, plural, and n, and then evaluates the remaining string. This allows the execution of arbitrary Perl commands contained within the header when the catalog is loaded. This issue can be exploited if an application sets the language attribute based on user-controlled input, such as request data, an Accept-Language header, or a locale parameter, provided the attacker can place a malicious .po file on the system.

Recommendations Update Data::MuForm::Localizer to a version newer than 0.05.