PT-2026-41236 · Cpan · Www::Mechanize::Cached

Oalders · Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-8612

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WWW::Mechanize::Cached versions prior to 2.00

Description When no explicit cache backend is used, the software creates a default Cache::FileCache in /tmp/FileCache with a directory umask of 000, resulting in a cache root and subdirectories with mode 0777 and no sticky bit. This allows a local attacker with write access to the cache tree to replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob. When the victim performs a get() request for that URL, the system reads the entry using Storable::thaw. If the victim process has loaded any class with a side-effectful STORABLE thaw, DESTROY, or overload hook, this can lead to local response forgery and arbitrary code execution.

Recommendations Update to version 2.00 or later.

Exploit

Fix

Deserialization of Untrusted Data

Incorrect Permission

Weakness Enumeration

CWE-502

CWE-732

Related Identifiers

CVE-2026-8612

Affected Products

Www::Mechanize::Cached

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8612.json · Exploit
• https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36 · Patch
• https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8612 · Security Note
• https://osv.dev/vulnerability/CVE-2026-8612 · Vendor Advisory
• https://github.com/libwww-perl/WWW-Mechanize-Cached · Note
• https://twitter.com/oss_security/status/2055157445891117229 · Twitter Post
• http://openwall.com/lists/oss-security/2026/05/15/1 · Note
• https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes · Note
• https://t.me/cveNotify/163578 · Telegram Post
• https://cpan.org/modules · Note