Privilege escalation via current-directory module hijacking

Uncontrolled search path in Encode.pm 3.05 through 3.11 allows local users to gain privileges through a crafted library. Encode.pm assigns @INC using a logical OR that evaluates the array in scalar context and replaces its search paths with an integer, allowing require to load Encode::ConfigLocal from the current directory. Exploitation requires an unusual configuration in which an attacker can write to the working directory and a more privileged user runs Perl there with Encode loaded.