Local Code Execution Vulnerability in WWW::Mechanize::Cached for Perl
CVE-2026-8612
5.3MEDIUM
What is CVE-2026-8612?
The WWW::Mechanize::Cached module in Perl prior to version 2.00 is susceptible to local response forgery and arbitrary code execution due to insecure deserialization of cached HTTP responses. The module utilizes a default FileCache under /tmp/FileCache, creating directories with a permission mode of 0777, allowing any local attacker with write access to modify cache entries. This exploitation could lead to attackers replacing legitimate cache entries with malicious content, which upon access, may result in arbitrary code execution in a vulnerable process if it has loaded classes with specific hooks or side effects.
Affected Version(s)
WWW::Mechanize::Cached 0 < 2.00