CVE-2026-116271

Full vulnerability record from the local CVENow database.

Description

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-28 18:17:13.580000

Last modified

2026-10-29 15:11:53

View original CVE JSON

{
  "id": "CVE-2026-116271",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-28T18:17:13.580",
  "lastModified": "2026-10-29T15:11:53.000",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "MIME-tools",
          "modules": [
            "MIME::Parser::FileUnder"
          ],
          "programFiles": [
            "lib/MIME/Parser/Filer.pm",
            "lib/MIME/Body.pm"
          ],
          "programRoutines": [
            {
              "name": "MIME::Parser::FileUnder::init_parse"
            },
            {
              "name": "MIME::Parser::Filer::find_unused_path"
            }
          ],
          "repo": "https://salsa.debian.org/dskoll/mime-tools",
          "packageURL": "pkg:cpan/MIME-tools",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.521",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}