CVE-2014-7236: TWiki Plugins.pm eval injection allows remote Perl code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote code execution with a CVSS 3.1 score of 9.1, public exploit references, and a very high EPSS percentile make this an urgent fix despite no KEV listing.

What it is

TWiki before 6.0.1 contains an eval injection flaw in lib/TWiki/Plugins.pm. The debugenableplugins parameter passed to do/view/Main/WebHome is evaluated as Perl code, letting a remote attacker run arbitrary Perl on the server. The record gives no affected version list beyond 'before 6.0.1' and no vendor advisory.

Impact

An unauthenticated remote attacker can execute arbitrary Perl code with the privileges of the TWiki web server process, leading to full compromise of the host and any data it can reach.

Attack surface

Reached over the network via an HTTP request to do/view/Main/WebHome with a crafted debugenableplugins parameter. The CVSS vector shows no privileges required and no user interaction, so the endpoint is directly reachable by an unauthenticated client.

Exploitation

CISA KEV does not list this CVE, but EPSS is 0.55637 (98.99th percentile) and multiple references are tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade TWiki to 6.0.1 or later, which is the fixed version named in the description.
• If upgrade is not immediately possible, restrict network access to the TWiki web interface to trusted users or an internal network.
• Disable or block the debugenableplugins parameter at the web server or reverse proxy before requests reach TWiki.
• Review TWiki plugin configuration and remove any debug or diagnostic parameters that accept user input.
• Run the TWiki service under a low-privilege account with no access to sensitive files or the host shell.

Detection

• Search web server and TWiki logs for requests to do/view/Main/WebHome containing debugenableplugins.
• Alert on Perl process activity spawned by the TWiki web server user, especially unexpected child processes or outbound connections.
• Monitor for unusual file writes or new files in the TWiki installation directory.
• Use the public exploit references to build signatures for known payload patterns in the debugenableplugins parameter.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.