Data::DisjointSet::Shared CVE-2026-65069

Exploitation requires local shell access to the host running the vulnerable Perl application - no network-level attack path exists. The vulnerable code path is triggered whenever Data::DisjointSet::Shared initialises a shared segment, which places a backing file in a globally writable directory such as /tmp or /dev/shm. For the passive information-disclosure variant (reading the world-readable file), the only prerequisite is that another local account exists on the same host. For the pre-planting race variant (O_EXCL absent), the attacker must write to the target directory before the application creates its segment, requiring knowledge of the expected filename. For the symlink-redirect variant (O_NOFOLLOW absent), the attacker must place a symlink at the exact backing-file path before the application opens it. Exploitation is limited to multi-user deployments; single-user or containerised environments with no co-tenancy are not meaningfully exposed. Non-default configurations do not increase risk - the insecure defaults apply unconditionally.

Real-world risk is low despite the straightforward exploitation path. CVSS 3.1 scores this at 4.0 (Medium) with AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting local-only access with limited confidentiality impact. EPSS at 0.16% (6th percentile) aligns with this assessment - exploitation is theoretically trivial but demand is negligible, almost certainly because the affected module has a narrow, specialist deployment footprint. The CVE is not in CISA KEV, no public exploit code has been identified, and CPANSec (the reporting party) is the primary source, suggesting responsible coordinated disclosure rather than active threat activity. The most impactful sub-vector is the O_NOFOLLOW omission, which could enable an attacker to redirect writes beyond mere reading; however, the assigned CVSS does not reflect an integrity component (I:N). This is a genuine but low-priority issue: organisations that do not run multi-user Perl applications using this specific module face zero exposure. Patch friction is minimal as version 0.02 is already available.

A local attacker on a multi-user Linux system (e.g., a shared hosting environment or HPC cluster) plants a symlink at the expected mmap backing-file path in /tmp before the target Perl application initialises its shared segment. When the vulnerable module opens the path without O_EXCL or O_NOFOLLOW, the symlink is followed, redirecting the open to an attacker-controlled file; alternatively, the attacker simply reads the world-readable 0644 backing file after it is created, recovering IPC payloads exchanged between the cooperating Perl processes. No public exploit code has been identified; the attack requires local shell access to the target host.