CVE-2026-65069 Details
Description
Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in dsu.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.
A vulnerability exists in Data::DisjointSet::Shared for Perl, affecting versions prior to 0.02. The issue arises because the software creates a world-readable memory-mapped backing file and opens it without exclusive or symlink-following protections. The file is generated with a default permission of 0666, leading to a world-readable mode of 0644 under the typical umask. The absence of O_NOFOLLOW allows symlinks to be followed, and without O_EXCL, the open operation can be tricked into using a pre-existing file instead of failing. This vulnerability allows local users to read IPC payloads from the world-readable segment and potentially exploit pre-creation races or redirect file openings using planted symlinks or files.
Users can upgrade to Data::DisjointSet::Shared version 0.02 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/changes | CPANSec | Vendor |
| https://metacpan.org/release/EGOR/Data-DisjointSet-Shared-0.02/diff/EGOR/Data-DisjointSet-Shared-0.01#dsu.h | CPANSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | CPANSec |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Data::DisjointSet::Shared | < 0.02 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | CPANSec |