Spreadsheet::ParseExcel CVE-2023-7101: Excel-File Perl RCE
Barracuda ESG fixed itself automatically in December 2023; the lingering risk is Perl code that still parses untrusted spreadsheets with Spreadsheet::ParseExcel 0.65 or older, often in vendored or appliance copies.
Must act: Teams running Perl services, mail filters or appliances that parse uploaded or emailed XLS/XLSX files with Spreadsheet::ParseExcel 0.65 or earlier, directly or through Spreadsheet::ParseXLSX.
Can relax: Barracuda ESG customers, whose appliances received the fix automatically on Dec 21, 2023, and Perl installs already on ParseExcel 0.66 or a patched Debian package.
- Print the installed version on every Perl host: perl -MSpreadsheet::ParseExcel -e 'print $Spreadsheet::ParseExcel::VERSION'.
- Upgrade to 0.66 with cpanm, or install your distro's patched package.
- Grep codebases, vendored lib/ trees and container images for the vulnerable line eval "$number $conditional" and replace those copies.