Detections
Analytics
Alpine: multiple perl-www-mechanize-cached packages: security update to 2.00-r0
medium Tenable Cloud Security Plugin ID 442556
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-
writable on-disk cache, enabling local response forgery and code execution. With no explicit cache
backend, WWW::Mechanize::Cached constructs a default Cache::FileCache under /tmp/FileCache without
overriding the backend's documented directory_umask of 000, so the cache root and its subdirectories are
created mode 0777 with no sticky bit. Cache entries are named by sha1_hex of the request and read back
through Storable::thaw on the next cache hit. A local attacker with write access to the cache tree can
replace a victim's cache entry for a known URL with an arbitrary frozen HTTP::Response blob, causing the
victim's next get() of that URL to return attacker controlled response bytes. Because the bytes are passed
to Storable::thaw, a victim process that has loaded any class with a side-effectful STORABLE_thaw,
DESTROY, or overload hook can be escalated to arbitrary code execution. (CVE-2026-8612)
Solution
Update the perl-www-mechanize-cached library and its related packages to version 2.00-r0 or later.See Also
Plugin Details
Severity: Medium
ID: 442556
Version: Revision 1.2
Type: Local
Published: 6/1/2026
Updated: 6/3/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Medium
Score: 4.2
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2026-8612
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.6
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 5/15/2026
Reference Information
CVE: CVE-2026-8612