Vulnerability in Data::Intern::Shared for Perl Allows Local File Access

CVE-2026-65067

What is CVE-2026-65067?

The Data::Intern::Shared module for Perl prior to version 0.02 has a vulnerability that enables local users to read sensitive IPC payloads. This occurs because the mmap backing file is created with permissive modes, specifically 0666, resulting in world-readable access under typical umask settings. Additionally, the absence of O_NOFOLLOW allows symlink redirection, permitting an attacker to exploit this by creating a symlink to a malicious file, thus gaining unauthorized access to information meant to be secured.

References