Data::Intern::Shared versions before 0.02 open an mmap backing file with open(path, O_RDWR|O_CREAT, 0666). Under the normal umask of 022 this results in a 0644 world‑readable file. The call also omits O_NOFOLLOW and O_EXCL, so a symlink or pre‑existing file at the expected path is followed or silently reused. The module therefore creates a shared memory area backed by a world‑readable file in a common shared directory such as /tmp or /dev/shm, letting local users read or tamper with any IPC payload stored there. This constitutes an insecure file‑creation weakness (CWE‑732) and a symlink‑based path traversal (CWE‑59).

The vulnerability affects installations of the Perl distribution EGOR:Data::Intern::Shared, specifically any version earlier than 0.02. Systems that use the module in shared directories such as /tmp or /dev/shm are at risk, as these directories are normally accessible to all local users and are the default locations for the mmap backing file.

The CVSS score is 3.8 and the EPSS indicates a very low exploitation probability (<1 %). This vulnerability is not listed in CISA’s KEV catalog. The attack vector is local; a user with write access to a shared directory such as /tmp or /dev/shm can create or pre‑plant a symlink or file at the expected path. Because the module uses O_NOFOLLOW and O_EXCL incorrectly, the open silently follows the symlink or reuses the pre‑existing file, creating a race that can be exploited. A victim local user can then read or overwrite the world‑readable backing file, gaining access to IPC payloads or altering program behavior. While the risk remains confined to local users, the race condition and lack of exclusive creation make exploitation easier than in a model that enforced O_EXCL.