World-Readable File Vulnerability in Perl's Data::SpatialHash::Shared

CVE-2026-65068

What is CVE-2026-65068?

The Data::SpatialHash::Shared module for Perl prior to version 0.02 is susceptible to a vulnerability where it creates a world-readable mmap backing file. This occurs due to the use of the file mode 0666, leading to the file being created with user permissions allowing read access to all local users. Additionally, the absence of O_NOFOLLOW allows symlink redirection, and the lack of O_EXCL permits silent reuse of pre-existing files unless a new file is created. Consequently, any local user can access sensitive IPC payloads stored within, posing a significant risk of information exposure.

References