Local privilege escalation via current-directory shell hijacking

Untrusted search path handling in affected Perl for Windows releases allows local users to execute arbitrary code as an administrator. When Perl invokes the Windows shell, its path search checks the current working directory for cmd.exe before trusted system locations. A low-privileged user must plant a malicious cmd.exe in a writable directory that an administrator later uses to launch an executable through Perl.