CVE-2026-65061

Received Received - Intake

Insecure File Permissions in Data::ReqRep::Shared Perl Module

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description

Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in reqrep.h with open(path, O_RDWR | O_CREAT, 0666), for both the request-reply and the integer-variant segments. The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-65061

EUVD

EUVD-2026-46374

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Perl module Data::ReqRep::Shared before version 0.05. It creates a shared memory file that is readable by all users due to incorrect file permissions (0644). The file is opened without proper security flags like O_EXCL or O_NOFOLLOW, allowing attackers to exploit race conditions or symlink attacks to access sensitive data.

Detection Guidance

Check for world-readable files in shared directories like /tmp or /dev/shm with permissions 0644. Look for files matching Data::ReqRep::Shared patterns. Use commands like 'find /tmp -type f -perm 0644 -ls' or 'ls -la /tmp | grep -E "reqrep|shared"'.

Impact Analysis

If you use this Perl module, local attackers could read sensitive data stored in shared memory segments. This includes IPC payloads that may contain confidential information. The vulnerability enables unauthorized access to data due to weak file permissions and lack of proper file handling.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Compliance may be compromised if sensitive personal or health data is accessed by unauthorized parties through the shared memory segment.

Mitigation Strategies

Update Data::ReqRep::Shared to version 0.05 or later. Remove world-readable permissions from shared directories. Use O_EXCL and O_NOFOLLOW flags in file creation. Monitor for suspicious symlinks or pre-planted files in /tmp or /dev/shm.

Hi! I’m here to help you understand CVE-2026-65061. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70