CVE-2026-8612

{
  "id": "CVE-2026-8612",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-05-15T02:16:23.843",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "Las versiones de WWW::Mechanize::Cached anteriores a la 2.00 para Perl deserializan respuestas HTTP cacheadas de una caché en disco con permisos de escritura para todos, lo que permite la falsificación local de respuestas y la ejecución de código.\n\nSin un backend de caché explícito, WWW::Mechanize::Cached construye un Cache::FileCache predeterminado bajo /tmp/FileCache sin anular el directory_umask documentado del backend de 000, por lo que la raíz de la caché y sus subdirectorios se crean con el modo 0777 y sin el bit sticky. Las entradas de la caché se nombran mediante el sha1_hex de la solicitud y se leen de nuevo a través de Storable::thaw en el siguiente acierto de caché.\n\nUn atacante local con acceso de escritura al árbol de la caché puede reemplazar la entrada de caché de una víctima para una URL conocida con un blob HTTP::Response congelado arbitrario, haciendo que el siguiente get() de esa URL de la víctima devuelva bytes de respuesta controlados por el atacante. Debido a que los bytes se pasan a Storable::thaw, un proceso víctima que ha cargado cualquier clase con un hook STORABLE_thaw, DESTROY o de sobrecarga con efectos secundarios puede ser escalado a ejecución de código arbitrario."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "OALDERS",
          "product": "WWW::Mechanize::Cached",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "WWW-Mechanize-Cached",
          "programFiles": [
            "lib/WWW/Mechanize/Cached.pm"
          ],
          "programRoutines": [
            {
              "name": "WWW::Mechanize::Cached::_build_cache"
            },
            {
              "name": "WWW::Mechanize::Cached::_make_request"
            }
          ],
          "repo": "https://github.com/libwww-perl/WWW-Mechanize-Cached",
          "versions": [
            {
              "version": "0",
              "lessThan": "2.00",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T14:30:45.332316Z",
          "id": "CVE-2026-8612",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:oalders:www\\:\\:mechanize\\:\\:cached:*:*:*:*:*:perl:*:*",
              "versionEndExcluding": "2.00",
              "matchCriteriaId": "38341BF2-29D0-4933-A81F-E8C46507590B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/05/15/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}