PatchTheCVECVE-2026-8612: WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable o
CVE-2026-8612 is a medium-severity flaw (CVSS 5.3) affecting www\. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution. With no explicit cache backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are created mode 0777 with no sticky bit. Cache en
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-8612?
www\: upgrade to 2.00. Exact commands for each OS are on this page.
Is CVE-2026-8612 being exploited?
CVE-2026-8612 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-8612 affect?
CVE-2026-8612 affects www\. Severity is medium (CVSS 5.3). WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution. With no explicit cache backend, WWW::Mechanize::Cached construc
How urgent is CVE-2026-8612?
Priority 19/100. No elevated risk signals yet.