Data::RadixTree::Shared versions prior to 0.02 open a memory‑mapped segment on disk using permissions 0666 and omit the O_EXCL and O_NOFOLLOW flags. The resulting file is world‑readable and, because symbolic links are followed, a local user can plant a symlink or pre‑create a file at the path to influence the open. These factors create a weakness in which a local user can read or potentially redirect data accessed by the module, exposing interprocess communication payloads and allowing a race condition or symlink attack. The flaw aligns with CWE‑732 (incorrect permission assignment) and CWE‑59 (path traversal via inadequate symlink checks).

The vulnerability affects the Perl module EGOR:Data::RadixTree::Shared in all releases before version 0.02. No specific distribution packages or operating systems are listed, but the issue occurs whenever the module is used in a Perl environment that creates the backing file in a shared directory such as /tmp or /dev/shm.

The CVSS score is 3.8, indicating a low severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack is likely local; a user with access to the shared directory can read the world‑readable file or attempt to substitute it with a symlink or pre‑created file, achieving information disclosure or a potential local race condition. No remote attack vector is implied by the available data.