CVE-2026-13082

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)

CWEs

CWE-338, CWE-804

Published

2026-07-17

Modified

2026-10-24

Record from

the NVD, synced 2026-10-25

References

• https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch
• https://www.cve.org/CVERecord?id=CVE-2025-40916

Check your stackJSON