Security Advisories (1)
CVE-2025-15578 (2026-02-16)

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

NAME

Maypole::HTTPD::Frontend - Maypole driver class for Maypole::HTTPD

DESCRIPTION

This is a simple CGI based Maypole driver for Maypole::HTTPD. It's used automatically as the frontend by Maypole::Application.

It overrides the following functions in CGI::Maypole:

get_request

Instantiates a CGI object representing the request.

send_output

Stores generated output in a buffer.

output_now

Actually output what's been buffered by send_output. Used by Maypole::HTTPD

SEE ALSO

Maypole, Maypole::HTTPD