Executive brief
WWW::Mechanize::Cached is a Perl library used to speed up web requests by storing copies of website responses on a computer's disk. A security flaw in versions before 2.00 creates these storage folders with insecure permissions, allowing any user on the same system to modify the cached data. An attacker could use this to feed fake information to the application or, in some cases, take full control of the process running the library.
Technical details
WWW::Mechanize::Cached (before version 2.00) defaults to using Cache::FileCache in /tmp/FileCache with a directory_umask of 000. This results in world-writable (0777) cache directories without a sticky bit. A local attacker can identify a victim's cache entry (keyed by SHA1 hash of the URL) and replace it with a malicious serialized HTTP::Response object. When the victim retrieves the cached URL, the library uses Storable::thaw to deserialize the attacker-controlled data. If the victim's process has loaded classes with side-effectful methods (such as STORABLE_thaw or DESTROY), this leads to arbitrary code execution. The fix in version 2.00 moves the default cache to the user's XDG cache home and enforces a umask of 077.
Affected products
- libwww-perl WWW::Mechanize::Cached < 2.00
Timeline
- 2026-05-13: disclosed: Issue reported to maintainers.
- 2026-05-14: patched: Version 2.00 released.
- 2026-05-15: advisory: Public disclosure via oss-security and NVD.