Improper File Permissions in Data::SortedSet::Shared Affecting Perl

CVE-2026-65062

What is CVE-2026-65062?

The Data::SortedSet::Shared module for Perl improperly manages file permissions by creating a world-readable mmap backing file. Under default configurations, the file is created with permissions allowing any local user to read sensitive IPC payloads. The absence of both O_NOFOLLOW and O_EXCL flags permits the exploitation of symlink attacks and pre-planted files, enabling local attackers to gain unauthorized access to sensitive data. This vulnerability highlights the need for stricter file permission settings in shared environments.

References