CVE-2023-47039 is a high severity flaw in Perl for Windows, scored 7.8. Perl looks for cmd.exe in the current working directory first, so a low-privileged user can plant one in a weak folder such as C:\ProgramData. Check for stray copies, tighten folder permissions, and update Perl when your distribution ships a fix.
What's affected
The record describes Perl on Windows, with no version list. Red Hat's entry repeats the description and states that the issue is Windows specific and that no Red Hat products are affected, so Linux builds are not the concern here.
Perl for Windows relies on the system path to find the shell, cmd.exe. Because of the search order, it checks the current working directory first. An attacker with limited privileges who can write to a folder like C:\ProgramData can place a file named cmd.exe there. When an administrator runs a Perl-based executable from that folder, the planted file runs instead.
Red Hat and NVD agree on the 7.8 score and on a local vector. One oddity is the weakness tags. The record lists CWE-122 and CWE-787, memory errors, which do not match the search path behavior described, so rely on the description. I could not confirm a fixed Perl version from the pages I read, so check your Perl distribution's release notes.
The NVD record was published on 2024-01-02, scores 7.8 (High), and carries the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Weakness class: CWE-122, CWE-787.
How to check if you're exposed
Look for stray copies of cmd.exe in places that users can write to, and for Perl-based executables run from those locations.
perl -v
Get-ChildItem -Path C:\ProgramData -Filter cmd.exe -Recurse -ErrorAction SilentlyContinue
The first command shows the Perl version in use. The second, run in PowerShell, lists any cmd.exe under C:\ProgramData. Anything found there that is not a known artifact deserves investigation. Also review the permissions on folders where administrators launch Perl tools.
What to do now
- List Windows systems that have Perl installed, including copies bundled with other software.
- Remove unexpected cmd.exe files from writable folders and investigate how they arrived.
- Tighten permissions so standard users cannot write to folders where administrators run tools.
- Avoid launching Perl-based executables from the current directory of a shared folder when running as an administrator.
- Update Perl through your distribution once a fixed build is available, and note the version.
Why it matters
This is an untrusted search path problem. Programs that locate helpers by name without a full path can be pointed at a look-alike if an attacker controls an earlier location in the search order. The result is code execution with the privileges of the person who runs the program.
The danger is highest where administrators work from shared or writable locations. The attacker needs a foothold with limited rights first, so this is a step in a longer chain. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Because the weakness is about environment rather than a library defect, scanning for versions will not catch it. A review of folder permissions will.
Quick check
Does this affect Linux?
Red Hat's entry says the issue is Windows specific and that no Red Hat products are affected.
Sources
Last reviewed: 19 October 2026.
