CVE-2026-8612

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8612", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-05-14T16:30:23.954Z", "datePublished": "2026-05-15T01:11:55.018Z", "dateUpdated": "2026-05-15T14:31:14.593Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "WWW-Mechanize-Cached", "product": "WWW::Mechanize::Cached", "programFiles": ["lib/WWW/Mechanize/Cached.pm"], "programRoutines": [{"name": "WWW::Mechanize::Cached::_build_cache"}, {"name": "WWW::Mechanize::Cached::_make_request"}], "repo": "https://github.com/libwww-perl/WWW-Mechanize-Cached", "vendor": "OALDERS", "versions": [{"lessThan": "2.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-15T01:11:55.018Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36"}, {"tags": ["patch"], "url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to WWW-Mechanize-Cached 2.00 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-05-13T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "WWW-Mechanize-Cached 2.00 released with fix."}], "title": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/15/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-15T05:18:42.682Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-15T14:30:45.332316Z", "id": "CVE-2026-8612", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T14:31:14.593Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/05/15/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-15T05:18:42.682Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-8612", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T14:30:45.332316Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-15T14:31:09.871Z"}}], "cna": {"title": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/libwww-perl/WWW-Mechanize-Cached", "vendor": "OALDERS", "product": "WWW::Mechanize::Cached", "versions": [{"status": "affected", "version": "0", "lessThan": "2.00", "versionType": "custom"}], "packageName": "WWW-Mechanize-Cached", "programFiles": ["lib/WWW/Mechanize/Cached.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "WWW::Mechanize::Cached::_build_cache"}, {"name": "WWW::Mechanize::Cached::_make_request"}]}], "timeline": [{"lang": "en", "time": "2026-05-13T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2026-05-14T00:00:00.000Z", "value": "WWW-Mechanize-Cached 2.00 released with fix."}], "solutions": [{"lang": "en", "value": "Upgrade to WWW-Mechanize-Cached 2.00 or later."}], "references": [{"url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36", "tags": ["patch"]}, {"url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-05-15T01:11:55.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8612", "state": "PUBLISHED", "dateUpdated": "2026-05-15T14:31:14.593Z", "dateReserved": "2026-05-14T16:30:23.954Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-05-15T01:11:55.018Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "WWW-Mechanize-Cached", "product": "WWW::Mechanize::Cached", "programFiles": ["lib/WWW/Mechanize/Cached.pm"], "programRoutines": [{"name": "WWW::Mechanize::Cached::_build_cache"}, {"name": "WWW::Mechanize::Cached::_make_request"}], "repo": "https://github.com/libwww-perl/WWW-Mechanize-Cached", "vendor": "OALDERS", "versions": [{"lessThan": "2.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oalders:www\\:\\:mechanize\\:\\:cached:*:*:*:*:*:perl:*:*", "matchCriteriaId": "38341BF2-29D0-4933-A81F-E8C46507590B", "versionEndExcluding": "2.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution."}, {"lang": "es", "value": "Las versiones de WWW::Mechanize::Cached anteriores a la 2.00 para Perl deserializan respuestas HTTP cacheadas de una cach\u00e9 en disco con permisos de escritura para todos, lo que permite la falsificaci\u00f3n local de respuestas y la ejecuci\u00f3n de c\u00f3digo.\n\nSin un backend de cach\u00e9 expl\u00edcito, WWW::Mechanize::Cached construye un Cache::FileCache predeterminado bajo /tmp/FileCache sin anular el directory_umask documentado del backend de 000, por lo que la ra\u00edz de la cach\u00e9 y sus subdirectorios se crean con el modo 0777 y sin el bit sticky. Las entradas de la cach\u00e9 se nombran mediante el sha1_hex de la solicitud y se leen de nuevo a trav\u00e9s de Storable::thaw en el siguiente acierto de cach\u00e9.\n\nUn atacante local con acceso de escritura al \u00e1rbol de la cach\u00e9 puede reemplazar la entrada de cach\u00e9 de una v\u00edctima para una URL conocida con un blob HTTP::Response congelado arbitrario, haciendo que el siguiente get() de esa URL de la v\u00edctima devuelva bytes de respuesta controlados por el atacante. Debido a que los bytes se pasan a Storable::thaw, un proceso v\u00edctima que ha cargado cualquier clase con un hook STORABLE_thaw, DESTROY o de sobrecarga con efectos secundarios puede ser escalado a ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2026-8612", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8612", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-15T14:30:45.332316Z", "version": "2.0.3"}}]}, "published": "2026-05-15T02:16:23.843", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/05/15/1"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-732"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.00)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WWW::Mechanize::Cached", "source": "cna", "vendor": "OALDERS"}, "product": "www::mechanize::cached", "vendor": "oalders"}], "created": "2026-05-15T04:00:12.860665+00:00", "updated": "2026-05-17T17:01:54.574307+00:00", "vendors": ["oalders", "oalders$PRODUCT$www::mechanize::cached"]}