======================================================================== CVE-2026-15747 CPAN Security Group ========================================================================

CVE ID: CVE-2026-15747 Distribution: Mojolicious Versions: from 4.59 before 9.48

MetaCPAN: https://metacpan.org/dist/Mojolicious VCS Repo: https://github.com/mojolicious/mojo

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

Description ----------- Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle.

csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle.

An attacker able to query it can recover the token and pass csrfprotect validation.

Problem types ------------- - CWE-204 Observable Response Discrepancy - CWE-352 Cross-Site Request Forgery (CSRF)

Solutions --------- Upgrade to Mojolicious 9.48 or later.

References ---------- https://github.com/mojolicious/mojo/commit/01921fbbbbeca2d1397e082d4a647f9b84c24e27.patch https://metacpan.org/release/SRI/Mojolicious-9.48/changes

Timeline -------- - 2026-07-14: Version 9.48 released with fix.

Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.

These predictable default secrets can be exploited by an attacker to forge session cookies.  An attacker who knows or guesses the secret could compute valid HMAC signatures for the session cookie, allowing them to tamper with or hijack another user’s session.

The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.

Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.

Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.

Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.

Cross-site scripting (XSS) vulnerability in the linkto helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

A directory traversal flaw was found in Mojolicious [1]. Because Mojolicious did not unescape paths before processing them, a user could use it to view arbitrary files using '%2f' rather than '/' (for example: %2f..%2f). This has been corrected in upstream version 1.17 [2].

[1] https://github.com/kraih/mojo/issues/114 [2] https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818

A directory traversal flaw was found in Mojolicious [1]. Because Mojolicious did not unescape paths before processing them, a user could use it to view arbitrary files using '%2f' rather than '/' (for example: %2f..%2f). This has been corrected in upstream version 1.17 [2].

[1] https://github.com/kraih/mojo/issues/114 [2] https://github.com/kraih/mojo/commit/b09854988c5b5b6a2ba53cc8661c4b2677da3818