CVE-2011-10043: Perl Module::Load RCE Vulnerability

CVE-2011-10043 Overview

CVE-2011-10043 affects the Perl Module::Load distribution in versions before 0.22. The load function accepts module names beginning with ::, which bypasses the standard @INC search path and allows arbitrary module file paths to be resolved and loaded. Attackers that can influence the module name argument passed to load can execute arbitrary Perl code within the target process. The weakness is classified under [CWE-145: Improper Neutralization of Section Delimiters].

Critical Impact
Applications that pass untrusted input to Module::Load::load can be coerced into loading and executing arbitrary Perl code outside of @INC, leading to remote code execution in the context of the Perl process.

Affected Products

Perl Module::Load versions prior to 0.22
Perl applications that pass externally influenced strings to the load function
Downstream CPAN distributions bundling Module-Load older than 0.22

Discovery Timeline

2026-07-07 - CVE-2011-10043 published to the National Vulnerability Database (NVD)
2026-07-07 - Last updated in the NVD database

Technical Details for CVE-2011-10043

Vulnerability Analysis

The Module::Load distribution provides a convenience wrapper around Perl's require for loading modules by name. In versions prior to 0.22, the load function did not validate module name syntax. Passing a string that begins with :: caused the resolver to treat the value as a file path segment rather than a fully qualified module identifier constrained to @INC. As a result, callers could reach modules on disk that Perl would normally refuse to load through the standard package resolution path.

This becomes a code execution primitive when the module name is derived from user input. Perl executes top-level code in any loaded .pm file at load time, so any attacker-controlled file that Perl can read may be executed. The vulnerability is tagged as network-exploitable because Perl web applications frequently expose module dispatch through parameters such as plugin names, controllers, or handler classes.

Root Cause

The root cause is missing neutralization of the package separator sequence :: at the start of the module name argument. The pre-0.22 implementation converted the caller-supplied string into a path without rejecting inputs that would escape the @INC-relative namespace. The fix in Module-Load-0.22 adds validation so that names starting with :: are treated as invalid module identifiers.

Attack Vector

Exploitation requires an application that forwards untrusted data to Module::Load::load. A typical pattern is a dispatcher that loads a class based on a query parameter, form field, or configuration value. An attacker submits a value beginning with :: followed by a path segment referencing a module reachable on the file system. The load function resolves the path outside @INC and Perl executes the target file, giving the attacker code execution as the Perl process user. No authentication or user interaction is required when the vulnerable dispatcher is exposed on the network.

Refer to the Perl Blog on Module Loading and the MetaCPAN Module Load Diff for the specific code change.

Detection Methods for CVE-2011-10043

Indicators of Compromise

Application logs containing HTTP parameters or CLI arguments whose values start with :: and are consumed by module dispatch logic
Unexpected Perl processes loading .pm files from paths outside declared @INC directories
New or modified .pm files in world-writable directories referenced by exploited applications
Outbound network connections initiated by Perl worker processes shortly after suspicious request handling

Detection Strategies

Perform static analysis of Perl code bases for calls to Module::Load::load and load that receive tainted input
Inspect installed Module-Load versions across servers and flag any release earlier than 0.22
Enable Perl taint mode (-T) in production entry points to surface unsafe data flows into module loaders
Correlate web access logs with Perl process telemetry to identify requests that trigger unusual module resolution

Monitoring Recommendations

Monitor file access events from Perl interpreters for reads of .pm files outside standard library and @INC locations
Alert on process creation events where Perl spawns shells, interpreters, or network utilities from web application workers
Track CPAN and OS package inventories for Module-Load version drift after patching

How to Mitigate CVE-2011-10043

Immediate Actions Required

Upgrade Module-Load to version 0.22 or later on every host running Perl applications
Audit application code for any path where external input reaches load and add strict allow-list validation
Rebuild and redeploy container images and packaged applications that bundle the vulnerable CPAN release
Rotate credentials and secrets accessible from Perl processes if exploitation is suspected

Patch Information

The fix ships in Module-Load0.22, which rejects module names beginning with ::. See the MetaCPAN Module Load Changes for the release notes and the MetaCPAN Module Load Diff for the source-level change.

Workarounds

Wrap calls to Module::Load::load with a validator that rejects strings starting with :: or containing path separators
Constrain dispatchers to an explicit allow-list of module names rather than passing user input directly
Enable Perl taint mode (-T) to prevent tainted values from reaching the module loader

bash

# Upgrade Module::Load using cpanm
cpanm Module::Load@0.22

# Or via cpan shell
cpan -i BINGOS/Module-Load-0.22.tar.gz

# Verify installed version
perl -MModule::Load -e 'print $Module::Load::VERSION, "\n"'