LiveActive security incident?Get immediate response
CVE Record

CVE-2016-10374: perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the c...

perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users to overwrite arbitrary files by creating a symlink, as demonstrated by creating a perltidy.ERR symlink that the victim cannot delete.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

perltidy can write certain output files in the current directory without protecting against symlinks. On shared systems, a local user could set up a link so another user's perltidy-related run overwrites a file the victim can write. This is mainly a local data-integrity risk, not a remote internet-facing issue based on the provided sources.

Executive priority

Treat this as a moderate operational hardening item. It is not evidenced as remotely exploitable, but shared developer or build systems could suffer file overwrite impacts if old tooling and unsafe directory permissions coexist.

Technical view

CVE-2016-10374 affects perltidy through 20160302, including use through perlcritic, check-all-the-things, and other software. The issue is unsafe current-working-directory output handling without symlink-attack protection, demonstrated with perltidy.ERR. The source bundle provides no CVSS, CWE, or named fixed version.

Likely exposure

Exposure is most likely on Unix-like multi-user systems, build hosts, developer workstations, or CI environments running affected perltidy directly or indirectly in shared writable directories.

Exploitation context

The described attacker is local. They need the ability to create a symlink in the victim's working directory before the victim runs affected tooling. The provided sources do not show active exploitation or CISA KEV listing.

Researcher notes

The public record is sparse: NVD-style metadata in the bundle lacks CVSS and CWE, and only the Debian bug is cited as confirmation. Analysis should focus on local symlink behavior around perltidy output files and indirect tool invocation paths.

Mitigation direction

  • Check vendor or distribution guidance for fixed perltidy packages.
  • Upgrade perltidy if your packaged version is through 20160302.
  • Avoid running affected tooling in shared writable directories.
  • Use private build and lint workspaces with restrictive permissions.
  • Review indirect use through perlcritic and check-all-the-things.

Validation and detection

  • Inventory perltidy versions on developer, CI, and shared build systems.
  • Identify workflows invoking perltidy indirectly through Perl tooling.
  • Confirm work directories are not writable by untrusted local users.
  • Review package changelogs or vendor advisories for CVE-2016-10374 coverage.
  • Prioritize systems where multiple users share writable project directories.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-10374 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.