{"id":"CVE-2026-116271","aliases":["DEBIAN-CVE-2026-116271","EUVD-2026-112304","GHSA-x3mf-3f47-pgpf","UBUNTU-CVE-2026-116271","openSUSE-SU-2026:12347-1","openSUSE-SU-2026:22226-1"],"status":"published","title":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00131,"percentile":0.02708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2026-10-28T17:34:06Z","modified":"2026-11-05T21:34:42Z","fixes":[{"ecosystem":"Debian:14","package":"libmime-tools-perl","fixed_in":["5.522-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.510-1","5.510-2","5.510-3","5.512-1","5.513-1","5.514-1","5.515-1","5.517-1","5.518-1","5.519-1","5.520-1","5.522-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.515-1","5.517-1","5.518-1","5.519-1","5.520-1","5.522-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522-1"}]}],"versions":["5.515-1","5.517-1","5.518-1","5.519-1","5.520-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.503-1","5.504-1","5.505-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.505-1","5.507-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.508-1","5.509-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.509-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.509-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.510-3","5.512-1","5.513-1","5.514-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.517-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libmime-tools-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.515-1","5.517-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-MIME-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522.0-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-MIME-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.522.0-bp160.1.1"}]}],"bundled":10}],"references":[{"url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes","tags":["release-notes"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116271"},{"url":"https://github.com/advisories/GHSA-x3mf-3f47-pgpf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116271","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-116271","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116271","tags":["report"]},{"url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116267","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116269","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116273","tags":["web"]},{"url":"https://bugzilla.suse.com/1288714","tags":["report"]},{"url":"https://bugzilla.suse.com/1288715","tags":["report"]},{"url":"https://bugzilla.suse.com/1288716","tags":["report"]},{"url":"https://bugzilla.suse.com/1288717","tags":["report"]},{"url":"https://bugzilla.suse.com/1288718","tags":["report"]},{"url":"https://bugzilla.suse.com/1288719","tags":["report"]},{"url":"https://bugzilla.suse.com/1288720","tags":["report"]},{"url":"https://bugzilla.suse.com/1288721","tags":["report"]},{"url":"https://bugzilla.suse.com/1288722","tags":["report"]},{"url":"https://bugzilla.suse.com/1288723","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116271","title":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","status":"published","published":"2026-10-28T17:34:06.757Z","modified":"2026-11-05T20:38:49.025Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-59"],"updated_at":"2026-11-05T21:25:05.838392Z"}],"euvd":[{"id":"EUVD-2026-112304","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","status":"published","published":"2026-10-28T17:34:06Z","modified":"2026-11-05T20:38:49Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T22:02:10.772181Z"}],"ghsa":[{"id":"GHSA-x3mf-3f47-pgpf","title":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and...","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","status":"published","published":"2026-10-28T18:32:13Z","modified":"2026-11-05T21:34:42Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-05T21:56:36.974002Z"}],"nvd":[{"id":"CVE-2026-116271","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","status":"published","published":"2026-10-28T18:17:13.58Z","modified":"2026-11-05T21:18:38.83Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-05T23:57:22.237283Z"}],"osv":[{"id":"DEBIAN-CVE-2026-116271","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.  Each message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.  When the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","status":"published","published":"2026-10-28T18:17:13.58Z","modified":"2026-11-06T10:04:35.759853995Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"UBUNTU-CVE-2026-116271","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","status":"published","published":"2026-10-28T18:17:00Z","modified":"2026-11-07T01:45:11.492797667Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-07T01:57:06.567161Z"},{"id":"openSUSE-SU-2026:12347-1","title":"perl-MIME-tools-5.522.0-1.1 on GA media","description":"These are all security issues fixed in the perl-MIME-tools-5.522.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-29T00:00:00Z","modified":"2026-10-31T18:00:08.38815676Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22226-1","title":"Security update for perl-MIME-tools","description":"This update for perl-MIME-tools fixes the following issues:\n\nChanges in perl-MIME-tools:\n\n- updated to 5.522.0 (5.522)\n  * 5.522\n\t* VERSION 5.522 RELEASED\n\t* Many security issues were addressed (see the following ten CVEs)\n\t  Issues were brought to my attention, and patches supplied, by the\n\t  CPANSec security group.\n\t* parse_params: flag a parameter list that could not be parsed\n\t  Detect additional ambiguous parse situations when parameter\n\t  names contain illegal characters.  Fixes:\n\t  CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723\n\t* parse_params: check the boundary after RFC 2231 reassembly\n\t  Another ambiguous-parse case was missed (trailing space after\n\t  boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:\n\t  CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722\n\t* parse_params: Stricter checking for encoded boundaries; earlier\n\t  versions would miss some cases.  Fixes:\n\t  CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721\n\t* Cap the indentation levels in the Results: structure.  Otherwise,\n\t  specially-crafted messages could consume large amounts of memory.\n\t  Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720\n\t* parse_params: stop a comment match at the next parenthesis.\n\t  Otherwise, specially-crafted messages could cause the regex\n\t  back-tracker to consume large amounts of CPU time.  Note that\n\t  MIME::Parser does not correctly parse ((nested comments)) and\n\t  has never done so.  Fixes:\n\t  CVE-2026-116268 unclosed \"(\" comments backtrack CPU exhaustion. bsc#1288719\n\t* parse_params: re-encode filename* values without charset tricks\n\t  Specially-crafted messages could trick recommended_filename()\n\t  into returning an empty string instead of a plausible filename.\n\t  Fixes: CVE-2026-116269 RFC 2231 language tag empties filename. bsc#1288718\n\t* decode_mimewords: do not copy the input into each error.  Otherwise,\n\t  specially-crafted messages could consume large amounts of memory.\n\t  Fixes: CVE-2026-116270 each bad \"=?\" copies the input into $@. bsc#1288717\n\t* FileUnder: do not reuse an existing generated directory.  Otherwise,\n\t  attackers might be able to use symbolic links to get files created\n\t  in unexpected locations.  Fixes:\n\t  CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716\n\t* parse_params: flag comments other readers do not skip\n\t  Specially-crafted messages could create ambiguous messages without\n\t  setting the ambiguous_parse flag.  Fixes:\n\t  CVE-2026-116272  comment hides a duplicate boundary. bsc#1288715\n\t* Call whine() rather than error() if max_parts or max_depth is\n\t  exceeded during a parse.  This lets us return undef rather than\n\t  throwing an exception if ignore_errors() is set to 0.\n\t* Change to defaults: max_parts is now set to 1000 and max_depth\n\t  to 64 rather than being unlimited.  This should not affect most\n\t  real-world uses of MIME::tools, but you may need to increase\n\t  these values or set them to -1 (unlimited) if you run into trouble.\n\t      ***** NOTE INCOMPATIBILITY *****\n\t  Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714\n\t* Do not signal an ambiguous parse if we have filename=\"\" or\n\t  name=\"\"\n\t* Update author names in META.yml\n\t* Add git repo to META.yml\n  * 5.520\n\t* VERSION 5.520 RELEASED\n\t* MIME::Parser used O(N^2) CPU time and memory parsing a MIME\n\t  message nested N levels deep.  A smallish specially-crafted\n\t  message could DOS the computer by making it consume enormous\n\t  amounts of memory and CPU time.  The parser was modified to use\n\t  O(N) time and memory in this case.  Additionally, a new\n\t  MIME::Parser::max_depth() function was added to limit the nesting\n\t  depth before declaring a parse failure.  Problem was reported to\n\t  me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.\n\t* MIME::Parser would ignore multiple blank lines in a message\n\t  preamble when parsing it; this could break DKIM.  Problem pointed\n\t  out and fix suggested by Tim Henderson.\n\t* If a MIME boundary includes trailing whitespace, we mark the\n\t  parse as ambiguous.  Problem noted and patch submitted by\n\t  Christian Herdtweck\n  * 5.519\n\t* VERSION 5.519 RELEASED\n\t* Some (buggy) software creates base64-encoded parts as a\n\t  concatenation of multiple base64-encoded streams, and some client\n\t  software decodes each stream separately and concatenates the\n\t  results.  Duplicate this behavior in MIME::tools to prevent it\n\t  from being used as a mechanism to sneak dangerous content past a\n\t  security scanner.  Patch courtesy of Giorgio Premi\n\t  \u003cgiosh94mhz@gmail.com\u003e.\n\n- updated to 5.518.0 (5.518)\n  * 5.518\n\t* VERSION 5.518 RELEASED\n\t* Add tests for encoded \"boundary=XXX\" parameters and set\n\t  the ambiguous-parse flag if any are found.  Patch courtesy\n\t  of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\t  MIME::tools chooses to decode encoded boundary parameters.\n\t  MUA behaviors differ; Claws-Mail decodes them while Thunderbird\n\t  does not.\n\t* Don't ignore invalid whitespace after \"boundary=XXX\" parameter.\n\t  Patch courtesy of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\t* Ignore comments between tokens.  A header parameter can be\n\t  written foo(comment)=bar and it's the same as foo=bar.\n\t  Patch courtesy of Dominik Csapak \u003cd.csapak@proxmox.com\u003e\n\n- updated to 5.517.0 (5.517)\n  * 5.517\n\t* VERSION 5.517 RELEASED\n\t* Add a missing test message file that was causing tests to fail.\n  * 5.516\n\t* VERSION 5.516 RELEASED\n\t* Handle MIME parameters of the form param= better (ie,\n\t  a parameter with no value at all.)  It's treated the\n\t  same as param=\"\" rather than aborting the parse.\n\t* Diagnose additional types of malformed MIME as ambiguous.\n\t  Specifically, an empty boundary parameters like boundary= or\n\t  boundary=\"\" is treated as ambiguous.  Thanks to Stoiko Ivanov\n\t  \u003cs.ivanov@proxmox.com\u003e for pointing out this missing case.\n","status":"published","published":"2026-11-03T18:16:30Z","modified":"2026-11-04T14:15:29.468997774Z","updated_at":"2026-11-04T14:31:33.296313Z"}]}}