Data::Graph::Shared libraries prior to version 0.04 create an mmap backing file with open(path, O_RDWR|O_CREAT, 0666). The low permissions (mode 0666) combined with the absence of the safety flags O_EXCL and O_NOFOLLOW allow the created file to be world‑readable and to be overridden or redirected by a symlink, giving a local user the ability to read or replace the backing file content.

The issue affects installations of the EGOR Data::Graph::Shared module earlier than 0.04. Systems running these modules in shared directories such as /tmp or /dev/shm, where multiple local users exist, are at risk.

The CVSS score of 3.3 reflects a low overall risk; the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local file system access, and a user could read the shared memory contents or potentially replace the file through a race or symlink, which could lead to information disclosure. Only users with local access to the host can exploit this flaw; no network or elevated privileges are required.