EUVD-2026-46373
GHSA-w3vw-q5h9-gx9g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Local low-privileged read of world-readable file (AC:L, PR:L); scope changes because another process's IPC data is exposed (S:C); no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW.
The segment is created in pubsub.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing.
A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
AnalysisAI
Insecure shared-memory file creation in the Perl module Data::PubSub::Shared before version 0.07 exposes inter-process communication payloads to any local user on the system. The backing mmap file is created with mode 0666 (effective 0644 under umask 022), is placed in world-accessible directories such as /tmp or /dev/shm, and is opened without O_EXCL or O_NOFOLLOW, enabling both passive eavesdropping on IPC traffic and active pre-creation or symlink-redirect attacks. No public exploit code has been identified at time of analysis, and EPSS sits at the 6th percentile, indicating low current exploitation interest; however, the world-readable condition requires no race-winning and is trivially exploitable by any local authenticated user.
Technical ContextAI
Data::PubSub::Shared is a Perl CPAN module that implements a publish/subscribe IPC mechanism backed by a memory-mapped file (mmap). The shared segment is initialized in pubsub.h using a POSIX open() call with flags O_RDWR|O_CREAT and permissions 0666. Under the standard umask of 022, the resulting file permission is 0644, making it world-readable. Two additional security gaps compound this: the absence of O_EXCL means that if a file already exists at the target path the open succeeds silently rather than failing, allowing an attacker to pre-plant a file; and the absence of O_NOFOLLOW means that a symlink planted at the path is followed, enabling symlink-redirect attacks to arbitrary files. The affected CPE is cpe:2.3:a:egor:data::pubsub::shared:*:*:*:*:*:*:*:* covering all releases before 0.07. CWE-732 (Incorrect Permission Assignment for Critical Resource) precisely describes the root cause: a sensitive IPC resource is created with overly permissive mode bits in a shared namespace.
RemediationAI
Vendor-released patch: Data::PubSub::Shared 0.07, available on CPAN and documented at https://metacpan.org/release/EGOR/Data-PubSub-Shared-0.07/changes. Upgrade by running 'cpan Data::PubSub::Shared' or 'cpanm Data::PubSub::Shared' to pull version 0.07 or later, which corrects the file permission mask and adds O_EXCL and O_NOFOLLOW to the open call. If an immediate upgrade is not feasible, a compensating control is to configure the application to create its shared segment in a directory with restricted access (mode 0700, owned by the application user) rather than /tmp or /dev/shm; this eliminates world-read access without changing the module code. Note that restricting the directory is an application-level workaround and does not fix the underlying O_EXCL/O_NOFOLLOW deficiencies in pubsub.h, leaving the symlink and pre-creation race vectors open if the directory permissions are later relaxed.
The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginni
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can
Out-of-bounds memory disclosure in Data::Intern::Shared before 0.02, a Perl shared-memory string interning module, lets
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write acces
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully cont
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.0
Information disclosure in Data::RoaringBitmap::Shared Perl module before 0.02 allows local attackers to read sensitive I
Insecure mmap backing-file creation in Data::DisjointSet::Shared (Perl/CPAN) before 0.02 exposes inter-process IPC paylo
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication qu
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a m
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today