Local File Exposure in Data::Graph::Shared for Perl

CVE-2026-64615

What is CVE-2026-64615?

Data::Graph::Shared versions prior to 0.04 for Perl are susceptible to an issue wherein a world-readable memory-mapped backing file is unintentionally created. This occurs because the module opens the file with permissions set to 0666, resulting in a file mode of 0644 under the default umask. Local users can read sensitive IPC payloads from this segment located in shared directories like /tmp or /dev/shm. Additionally, the absence of O_NOFOLLOW allows for potential symlink attacks, and due to the lack of O_EXCL, an attacker could exploit this vulnerability to utilize a pre-existing file or symlink, enabling unauthorized access to sensitive data.

References