Security Advisories (1)
CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

NAME

installhtml - converts a collection of POD pages to HTML format.

SYNOPSIS

installhtml  [--help] [--podpath=<name>:...:<name>] [--podroot=<name>]
     [--htmldir=<name>] [--htmlroot=<name>]  [--norecurse] [--recurse]
     [--splithead=<name>,...,<name>]   [--splititem=<name>,...,<name>]
     [--ignore=<name>,...,<name>]  [--verbose]

DESCRIPTION

installhtml converts a collection of POD pages to a corresponding collection of HTML pages. This is used to convert the pod pages found in the perl distribution. (It is not intended as a general-purpose converter/installer of POD pages in HTML format. See Pod::Html.)

OPTIONS

--help help

Displays the usage.

--podroot POD search path base directory

The base directory to search for all .pod and .pm files to be converted. Default is current directory.

--podpath POD search path

The list of directories to search for .pod and .pm files to be converted. Default is 'podroot/lib'.

--recurse recurse on subdirectories

Whether or not to convert all .pm and .pod files found in subdirectories too. Default is to not recurse.

--htmldir HTML destination directory

The base directory which all HTML files will be written to. This should be a path relative to the filesystem, not the resulting URL.

--htmlroot URL base directory

The base directory which all resulting HTML files will be visible at in a URL. The default is '/'.

--splithead POD files to split on =head directive

Comma-separated list of pod files to split by the =head directive. The .pod suffix is optional. These files should have names specified relative to podroot.

--splititem POD files to split on =item directive

Comma-separated list of all pod files to split by the =item directive. The .pod suffix is optional. installhtml does not do the actual split, rather it invokes splitpod, a separate program in the Perl 5 core distribution, to do the dirty work. As with --splithead, these files should have names specified relative to podroot.

--splitpod Directory containing the splitpod program

The directory containing the splitpod program. The default is 'podroot/pod'.

--ignore files to be ignored

Comma-separated of files that shouldn't be installed, given relative to podroot.

--verbose verbose output

Self-explanatory.

EXAMPLE

The following command-line is an example of the one we use to convert perl documentation:

    ./installhtml --podpath=lib:ext:pod:vms   \
			--podroot=/usr/src/perl     \
			--htmldir=/perl/nmanual     \
			--htmlroot=/perl/nmanual    \
			--splithead=pod/perlipc     \
			--splititem=pod/perlfunc    \
			--recurse \
			--verbose

AUTHOR

Chris Hall <hallc@cs.colorado.edu>