Vulnerability record · CVE-2012-6329 · published 4 January 2013
CVE-2012-6329: Perl Locale::Maketext code injection via crafted translation strings
Perl · Perl
The _compile function in Locale::Maketext's Maketext.pm in Perl before 5.17.7 mishandles backslashes and fully qualified method names when compiling bracket notation, allowing injected Perl code to run. Applications that pass user-supplied translation strings into this library, such as TWiki before 5.1.3 and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, are exposed to remote command execution.
Description
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote, unauthenticated code execution with a very high EPSS score, though no confirmed in-the-wild exploitation is recorded.
What it is
The _compile function in Locale::Maketext's Maketext.pm in Perl before 5.17.7 mishandles backslashes and fully qualified method names when compiling bracket notation, allowing injected Perl code to run. Applications that pass user-supplied translation strings into this library, such as TWiki before 5.1.3 and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, are exposed to remote command execution.
Impact
An attacker who can supply translation strings gains arbitrary command execution in the context of the Perl application, leading to full compromise of the host or application data.
Attack surface
Reached over the network through any application interface that accepts user-controlled translation strings and feeds them to Locale::Maketext; the CVSS vector AV:N/AC:L/Au:N indicates no authentication is required, and no user interaction is described.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.63488 (99.17th percentile), indicating a high modeled likelihood of exploitation.
What to do
- Upgrade Perl to 5.17.7 or later, or apply the vendor patch referenced in the perl5.git commit.
- Upgrade TWiki to 5.1.3 or later and Foswiki past the affected 1.0.x and 1.1.x ranges.
- Apply distribution backports (Debian, Ubuntu USN-2099-1, Red Hat RHSA-2013-0685, Mandriva, Mageia) where a full Perl upgrade is not possible.
- Do not pass untrusted user input as translation strings to Locale::Maketext; validate or restrict such input at the application layer.
Detection
- Monitor application and web logs for translation strings containing backslashes or fully qualified method names in bracket notation.
- Alert on unexpected child processes or shell execution spawned by Perl web applications (TWiki, Foswiki).
- Audit installed Perl and TWiki/Foswiki versions against the fixed releases to find unpatched instances.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2012-6329 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-6329), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
