Vulnerability Description
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-116271?
CVE-2026-116271 is a documented vulnerability. MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a dir...
How severe is CVE-2026-116271?
CVSS scoring is not yet available for CVE-2026-116271. Check NVD for updates.
Is there a patch for CVE-2026-116271?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.