Data::MuForm::Localizer through version 0.05 constructs a message catalog path using an unvalidated language attribute, allowing path traversal to any readable .po file. The catalog’s Plural-Forms header is parsed and evaluated, so an attacker can embed Perl code that is executed when the catalog loads. This defect enables arbitrary code execution with the privileges of the running application, exposing it to fully compromising the host and data it serves. The weakness is a combination of path traversal (CWE-22) and command injection via code evaluation (CWE-95).

The vulnerability affects the Data::MuForm::Localizer Perl module in all releases up to and including 0.05. No other vendors or products are listed; the issue is contained to this module’s handling of the language attribute and message catalog loading mechanisms.

Because the flaw permits execution from an attacker-controlled .po file that can be referenced through a manipulated language attribute supplied in request data (such as a URL or Accept-Language header), the likely attack vector is a web request. The exploit requires the attacker to have write access to the file system at a location with a .po suffix, and the application must be running with permissions sufficient to read that file. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of remote code execution and the lack of input validation elevate the risk to high. Applying the available patch is strongly recommended to mitigate the risk before exploitation can fully materialize.