{"id":"CVE-2026-8612","aliases":["ALPINE-CVE-2026-8612","EUVD-2026-30495","GHSA-38r9-g25v-vcvr","MGASA-2026-0149"],"status":"published","title":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00127,"percentile":0.02361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502","CWE-732"],"published":"2026-05-15T01:11:55Z","modified":"2026-11-03T06:33:04Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"perl-www-mechanize-cached","fixed_in":["2.00-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"perl-www-mechanize-cached","fixed_in":["2.00-r0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-WWW-Mechanize-Cached","fixed_in":["2.0.0-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Path-Tiny","fixed_in":["0.150.0-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-File-XDG","fixed_in":["1.30.0-1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"perl-www-mechanize-cached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.00-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-www-mechanize-cached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.00-r0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-WWW-Mechanize-Cached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Path-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.150.0-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-File-XDG","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1.mga9"}]}]}],"products":[{"vendor":"oalders","product":"www::mechanize::cached"},{"vendor":"oalders","product":"www\\"}],"references":[{"url":"https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36","tags":["patch","Issue Tracking","Patch","fix"]},{"url":"https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch","tags":["patch","Patch","fix"]},{"url":"https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes","tags":["release-notes","Release Notes","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/15/1","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8612","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-38r9-g25v-vcvr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-8612","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8612.json","tags":["advisory"]},{"url":"https://github.com/libwww-perl/WWW-Mechanize-Cached","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0149.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35533","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/15/1","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-8612","title":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","status":"published","published":"2026-05-15T01:11:55.018Z","modified":"2026-05-15T14:31:14.593Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-732","CWE-502"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-30495","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","status":"published","published":"2026-05-15T01:11:55Z","modified":"2026-05-15T14:31:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:04:28.872228Z"}],"ghsa":[{"id":"GHSA-38r9-g25v-vcvr","title":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a...","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","status":"published","published":"2026-05-15T03:30:36Z","modified":"2026-05-15T15:31:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:08:10.185094Z"}],"nvd":[{"id":"CVE-2026-8612","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","status":"published","published":"2026-05-15T02:16:23.843Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-502","CWE-732"],"updated_at":"2026-11-02T14:12:19.39893Z"}],"osv":[{"id":"ALPINE-CVE-2026-8612","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","status":"published","published":"2026-05-15T02:16:23.843Z","modified":"2026-11-03T06:33:04.144184526Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-8612","title":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.","status":"published","published":"2026-05-15T01:11:55.018Z","modified":"2026-10-28T02:30:45.388293708Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-502","CWE-732"],"updated_at":"2026-11-02T15:45:18.825071Z"},{"id":"MGASA-2026-0149","title":"Updated perl-WWW-Mechanize-Cached, perl-File-XDG \u0026 perl-Path-Tiny packages fix security vulnerabilities","description":"WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached\nHTTP responses from a world-writable on-disk cache, enabling local\nresponse forgery and code execution.\n","status":"published","published":"2026-05-18T19:12:53Z","modified":"2026-05-18T19:15:07.134542Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}