World-readable File Vulnerability in Data::DisjointSet::Shared for Perl

CVE-2026-65069

What is CVE-2026-65069?

The Data::DisjointSet::Shared module for Perl prior to version 0.02 exhibits a security flaw that allows for the creation of a world-readable mmap backing file. Due to improper file creation flags—specifically, the absence of O_EXCL and O_NOFOLLOW—an attacker can exploit this vulnerability by planting a symlink or pre-created file at the designated path. The file is generated with the mode 0666, allowing all users to read the IPC payloads stored within, thereby exposing sensitive information in shared directories like /tmp or /dev/shm. Local users can leverage this weakness for unauthorized access to data, making proper permissions and file handling critical.

References