# CVE-2026-65067: Data::Intern::Shared insecure file permissions and symlink following

Source: https://junglewise.ai/threats/cve-2026-65067-data-intern-shared-insecure-file-permissions-and-symlink  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-65067 · Severity: info · CVSS 0 · Published 2026-07-21

A vulnerability in the Data::Intern::Shared Perl module allows local users on a shared system to access sensitive data. The module creates temporary files with insecure permissions, meaning any user on the same machine can read the information stored within them. Additionally, an attacker could trick the software into writing data to the wrong location or hijacking the data stream, potentially leading to information theft or system disruption.

Vendors: [Vividsnow](https://junglewise.ai/threats/vendors/vividsnow).

## Quick answers

**Is CVE-2026-65067 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65067 being exploited in the wild.

**How severe is CVE-2026-65067?** Informational severity, with a CVSS score of 0, published 21 July 2026.

**Which products and versions are affected?** Vividsnow Data::Intern::Shared < 0.02.

**Is there a fix for CVE-2026-65067?** A patch was published on 2026-07-21: Fixed in version 0.02 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65067 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-65067?** Check whether you run Vividsnow Data::Intern::Shared at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in intern.h where the open() system call is used with O_RDWR|O_CREAT and a mode of 0666. Due to default umask settings (typically 022), this results in world-readable files (0644) in shared directories like /tmp or /dev/shm. Furthermore, the absence of O_NOFOLLOW and O_EXCL flags allows a local attacker to perform symlink attacks or win a race condition by pre-planting a file at the expected path. This enables unauthorized reading of IPC payloads and redirection of file operations. The issue is addressed in version 0.02.

## Affected products

- EGOR (vividsnow) Data::Intern::Shared < 0.02

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in version 0.02

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/changes](https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/changes)
- [https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/diff/EGOR/Data-Intern-Shared-0.01](https://metacpan.org/release/EGOR/Data-Intern-Shared-0.02/diff/EGOR/Data-Intern-Shared-0.01)