CVE-2026-13082 - Vulnerability Details - OpenCVE

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Burak	Gd::securityimage

No data.

No data.

References

Link	Providers
https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch
https://www.cve.org/CVERecord?id=CVE-2025-40916

History

Thu, 23 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Burak Burak gd::securityimage
Vendors & Products		Burak Burak gd::securityimage

Fri, 17 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 17 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string. The built-in rand function is unsuitable for security applications because it is predictable and reversible.
Title		GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets
Weaknesses		CWE-338 CWE-804
References		https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch https://www.cve.org/CVERecord?id=CVE-2025-40916

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-07-17T12:54:07.177Z

Updated: 2026-07-17T17:29:23.536Z

Reserved: 2026-06-23T18:17:08.243Z

Link: CVE-2026-13082

Vulnrichment

Updated: 2026-07-17T17:29:03.597Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13082", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-23T18:17:08.243Z", "datePublished": "2026-07-17T12:54:07.177Z", "dateUpdated": "2026-07-17T17:29:23.536Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "GD-SecurityImage", "product": "GD::SecurityImage", "programFiles": ["lib/GD/SecurityImage.pm"], "programRoutines": [{"name": "GD::SecurityImage::random"}, {"name": "GD::SecurityImage::random_angle"}, {"name": "GD::SecurityImage::particle"}], "repo": "https://github.com/burak/CPAN-GD-SecurityImage", "vendor": "BURAK", "versions": [{"lessThanOrEqual": "1.75", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-804", "description": "CWE-804 Guessable CAPTCHA", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-17T12:54:07.177Z"}, "references": [{"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2025-40916"}, {"tags": ["patch"], "url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2018-12-24T00:00:00.000Z", "value": "Version 1.75 released."}, {"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "The git repository was archived."}], "title": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets", "workarounds": [{"lang": "en", "value": "GD::SecurityImage has not been updated since 2018, the module is flagged as ADOPTME on CPAN, and the git repository is archived as read-only, which prevents issues and pull requests from being created.\n\nUsers are advised to find an alternative solution.\n\nFor users who are unable to migrate to an alternative, install Crypt::URandom::MonkeyPatch (which will override the built-in rand with a wrapper around Crypt::URandom) and apply the patch."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T17:29:10.397745Z", "id": "CVE-2026-13082", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T17:29:23.536Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13082", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T17:29:10.397745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T17:29:03.597Z"}}], "cna": {"title": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/burak/CPAN-GD-SecurityImage", "vendor": "BURAK", "product": "GD::SecurityImage", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.75"}], "packageName": "GD-SecurityImage", "programFiles": ["lib/GD/SecurityImage.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "GD::SecurityImage::random"}, {"name": "GD::SecurityImage::random_angle"}, {"name": "GD::SecurityImage::particle"}]}], "timeline": [{"lang": "en", "time": "2018-12-24T00:00:00.000Z", "value": "Version 1.75 released."}, {"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "The git repository was archived."}], "references": [{"url": "https://www.cve.org/CVERecord?id=CVE-2025-40916", "tags": ["related"]}, {"url": "https://security.metacpan.org/patches/G/GD-SecurityImage/1.75/CVE-2026-13082-r1.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "GD::SecurityImage has not been updated since 2018, the module is flagged as ADOPTME on CPAN, and the git repository is archived as read-only, which prevents issues and pull requests from being created.\n\nUsers are advised to find an alternative solution.\n\nFor users who are unable to migrate to an alternative, install Crypt::URandom::MonkeyPatch (which will override the built-in rand with a wrapper around Crypt::URandom) and apply the patch."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.\n\nThe random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.\n\nThe built-in rand function is unsuitable for security applications because it is predictable and reversible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-338", "description": "CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-804", "description": "CWE-804 Guessable CAPTCHA"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-17T12:54:07.177Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13082", "state": "PUBLISHED", "dateUpdated": "2026-07-17T17:29:23.536Z", "dateReserved": "2026-06-23T18:17:08.243Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-17T12:54:07.177Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}