The vulnerability in Data::ReqRep::Shared (versions <0.05) arises from incorrect permission assignment and insecure file opening of the mmap backing file used for IPC. The file is created with mode 0666, which under default umask results in world-readable permissions (0644). The open call does not use O_EXCL, allowing an attacker to pre-create a file and cause the open to succeed on the attacker's file instead of failing. The absence of O_NOFOLLOW allows following symlinks, enabling redirection of the open to arbitrary files. Since the shared segment resides in directories accessible to local users (e.g., /tmp or /dev/shm), this can expose IPC payloads to unauthorized local users and enable local pre-creation race or symlink attacks.

Local attackers can read inter-process communication payloads stored in the world-readable shared segment. They can also exploit the lack of O_EXCL and O_NOFOLLOW to pre-create files or symlinks, redirecting the open call to attacker-controlled files. This leads to information disclosure of IPC data. There is no indication of integrity or availability impact. The CVSS score is 3.8 (low severity) reflecting limited impact and local attack vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running Data::ReqRep::Shared in environments where untrusted local users have access to the shared directories used for the mmap files. Restrict permissions on the directories and files involved to trusted users only. Monitor vendor channels for official patches or updates addressing the use of O_EXCL and O_NOFOLLOW flags and file permission hardening.