This is a repost and update of https://rt.cpan.org/Public/Bug/Display.html?id=69277 - the bug tracker that CPAN points to appears to have changed at some point since 2011. A symlink attack via Data::UUID is possible. As user2: ln -s /home/user1/test-file /tmp/.UUID_STATE As user1: perl -MData::UUID -e 'Data::UUID->new' Then /home/user1/test-file is overwritten. There are two points in UUID.xs which write to UUID_STATE_NV_STORE - both the DESTROY() and create() functions are affected. On at least recent Debian kernels, it is necessary to disable symlink protection via "sysctl fs.protected_symlinks=0" to reproduce this issue. A similar attack is possible via .UUID_NODEID, but only if combined with exploiting the race condition between fopen and fwrite, so this is much more difficult to reproduce.