CPANSA-MIME-tools-2026-116271: MIME-tools vulnerability

Vulnerability Description

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.

Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.

When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.

Vulnerabilities

CVE-2026-116271

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.

Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.

When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.

Product status

Known affected

Fixed

• MIME-tools greater than or equal 5.521

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

• CPANSA-MIME-tools-2026-116271 JSON self
  https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-mime-tools-2026-116271.json
• https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes external
  https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
• CVE-2026-116271 (NVD) external
  https://nvd.nist.gov/vuln/detail/CVE-2026-116271

Revision history

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/