File Access Vulnerability in Data::PubSub::Shared by Perl

CVE-2026-64617

What is CVE-2026-64617?

Data::PubSub::Shared versions prior to 0.07 in Perl exhibit a significant security concern due to the creation of a world-readable mmap backing file. This vulnerability stems from improper file creation and access handling, which creates potential exposure of sensitive data. The library uses a 0666 file mode by default, leading to the creation of files that are readable by all local users under typical umask settings. Additionally, missing flags such as O_NOFOLLOW and O_EXCL allow attackers to manipulate file accesses through symlinks, enabling unauthorized reading of IPC payloads stored in compromised segments.

References