CVE-2026-65068

Received Received - Intake

Insecure File Permissions in Data::SpatialHash::Shared

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: CPANSec

Description

Data::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in sphash.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-65068

EUVD

EUVD-2026-46381

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Perl module Data::SpatialHash::Shared before version 0.02. It creates a shared memory file that is readable by all users due to incorrect file permissions and lack of security flags. The file is created with mode 0666, which under default settings becomes world-readable (0644). Additionally, the code does not use O_EXCL or O_NOFOLLOW flags, allowing attackers to exploit race conditions or symlink attacks to access sensitive data.

Detection Guidance

Check for world-readable mmap backing files in shared directories like /tmp or /dev/shm. Look for files with mode 0644 created by Data::SpatialHash::Shared versions before 0.02. Use commands like 'find /tmp -type f -perm 0644 -ls' or 'ls -la /dev/shm' to inspect file permissions.

Impact Analysis

If you use Data::SpatialHash::Shared before 0.02, local attackers could read sensitive data stored in shared memory segments. This includes IPC payloads in directories like /tmp or /dev/shm. Attackers might exploit race conditions or symlinks to access or manipulate this data, potentially leading to information disclosure or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If personal or health data is exposed, it may result in non-compliance with these regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Update Data::SpatialHash::Shared to version 0.02 or later. Remove any existing mmap backing files in shared directories and ensure new files are created with stricter permissions. Monitor for unauthorized access to shared segments.

Hi! I’m here to help you understand CVE-2026-65068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70