Description
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.14.2-16 | — |
| Debian 13 | perl | 5.14.2-16 | — |
| Debian 12 | perl | 5.14.2-16 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perl +3 | 4:5.10.1-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Archive-Extract | 1:0.38-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Archive-Tar | 1.58-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CGI | 3.51-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CPAN | 1.9402-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CPANPLUS | 0.88-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Compress-Raw-Zlib | 1:2.020-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Compress-Zlib +4 | 2.020-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Digest-SHA | 1:5.47-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-CBuilder | 1:0.27-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-Embed | 1.28-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-MakeMaker | 6.55-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-ParseXS | 1:2.2003.0-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-File-Fetch | 0.26-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-IO-Zlib | 1:1.09-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-IPC-Cmd | 1:0.56-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Locale-Maketext-Simple | 1:0.18-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Log-Message +2 | 1:0.02-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Log-Message-Simple | 0.04-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Build | 1:0.3500-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-CoreList | 2.18-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Load | 1:0.16-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Load-Conditional | 0.30-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Pluggable | 1:3.90-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Object-Accessor | 1:0.34-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Params-Check | 1:0.26-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Parse-CPAN-Meta | 1:1.40-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Pod-Escapes | 1:1.04-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Pod-Simple | 1:3.13-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Term-UI | 0.20-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Test-Harness | 3.17-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Test-Simple | 0.92-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Time-HiRes | 4:1.9721-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Time-Piece | 1.15-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-core | 5.10.1-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-parent | 1:0.221-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-version | 3:0.77-130.el6_4 | RHSA-2013:0685 |
| RHEL 5 | perl +1 | 4:5.8.8-40.el5_9 | RHSA-2013:0685 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | perl +10 | 5.42.2-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-AutoSplit +1 | 5.74-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-B | 1.89-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Benchmark +1 | 1.27-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Class-Struct | 0.68-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-DBM_Filter | 0.07-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Devel-Peek | 1.36-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Devel-SelfStubber | 1.06-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-DynaLoader | 1.57-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-English +1 | 1.11-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Errno | 1.38-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-ExtUtils-Constant | 0.25-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Fcntl +1 | 1.20-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-File-Basename | 2.86-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-File-Compare | 1.100.800-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-File-Copy | 2.41-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-File-DosGlob | 1.12-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-File-Find | 1.44-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-File-stat +3 | 1.14-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-FileHandle | 2.05-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-FindBin | 1.54-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-GDBM_File +1 | 1.24-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Hash-Util | 0.32-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-I18N-LangTags | 0.45-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-I18N-Langinfo | 0.24-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-IO | 1.55-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Locale-Maketext-Simple | 0.21-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Math-Complex | 1.63-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Memoize +1 | 1.17-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Module-Loaded | 0.08-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-NDBM_File | 1.18-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-NEXT | 0.69-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Net +3 | 1.04-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Opcode | 1.69-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-POSIX | 2.23-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Pod-Html +1 | 1.35-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Safe | 2.47-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Search-Dict | 1.08-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-SelectSaver +2 | 1.02-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-SelfLoader | 1.28-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Symbol | 1.09-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Sys-Hostname | 1.25-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Term-Complete | 1.403-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Test | 1.31-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Thread | 3.06-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Thread-Semaphore | 2.13-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Tie | 4.6-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Tie-Memoize | 1.1-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Time-Piece | 1.3600-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-Unicode-UCD | 0.81-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-base +2 | 2.27-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-blib | 1.07-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-debugger | 1.60-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-deprecate | 0.04-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-encoding-warnings | 0.14-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-filetest +1 | 1.03-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-if | 0.61.000-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-less +1 | 0.03-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-lib | 0.65-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-mro | 1.29-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-open +1 | 1.13-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-overload +1 | 1.40-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-overloading | 0.02-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-sigtrap +2 | 1.10-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-sort | 2.06-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
| Red Hat Hardened Images 1 | perl-vars +2 | 1.05-524.hum1 | RHSA-2026:80394, RHSA-2026:6206 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
TWiki MAKETEXT Remote Command Execution
exploit/unix/webapp/twiki_maketext
-
Foswiki MAKETEXT Remote Command Execution
exploit/unix/webapp/foswiki_maketext
Exploit-DB 2
- TWiki MAKETEXT - Remote Command Execution (Metasploit) EDB-23579 · remote · Dec 23, 2012 · verified
- Foswiki MAKETEXT - Remote Command Execution (Metasploit) EDB-23580 · remote · Dec 23, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2026:80394 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:6206 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2013:0685 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- MDVSA-2013:113 vendor-advisory
- http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
- [foswiki-announce] 20121212 Security Alert CVE-2012-6329: Foswiki MAKETEXT Variable Allows Arbitrary Shell Command Execution mailing-list
- http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
- http://perl5.git.perl.org/perl.git/blob/HEAD:/pod/perl5177delta.pod
- [perl5-porters] 20121205 Re: security notice: Locale::Maketext mailing-list
- [oss-security] 20121211 Re: CVE request: perl-modules mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=884354
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0032
- USN-2099-1 vendor-advisory
- [perl5-porters] 20121205 security notice: Locale::Maketext mailing-list
- RHSA-2013:0685 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
- 56950 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695224