Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-60074— Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

Quick assessment

Affected
CVE-2026-60074
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SBECK Date::Manip是SBECK个人开发者开源的一个日期处理模块。 SBECK Date::Manip 6.99及之前版本存在输入验证错误漏洞，该漏洞源于正则表达式使用\d简写匹配Unicode十进制数字而非仅ASCII数字，且验证仅用数值比较，导致非ASCII数字通过检查并返回错误日期。

AI Predicted 5.3 Difficulty: Moderate EPSS 0.37% · P31

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None ≤ 7.00 affected

I. Basic Information for CVE-2026-60074

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
Source: CVE Program / CVE List V5
Vulnerability Description
Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the `\d` shorthand, which on a character string matches the whole Unicode decimal digit property `\p{Nd}` and not just `[0-9]`. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone (`$y<1 || $y>9999`, `$m<1 || $m>12`, `$d<1 || $d>$days`), and _parse_check stores the numified fields (`$y+0`). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (`0?[0-9]`, `[0-5][0-9]`) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction. Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1289
Source: CVE Program / CVE List V5
Vulnerability Title
SBECK Date::Manip 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SBECK Date::Manip是SBECK个人开发者开源的一个日期处理模块。 SBECK Date::Manip 6.99及之前版本存在输入验证错误漏洞，该漏洞源于正则表达式使用\d简写匹配Unicode十进制数字而非仅ASCII数字，且验证仅用数值比较，导致非ASCII数字通过检查并返回错误日期。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 7.00 -

II. Public POCs for CVE-2026-60074

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-60074

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-60074 (1)

Other References for CVE-2026-60074 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1289

V. Comments for CVE-2026-60074

No comments yet

Leave a comment