Live › vulnerability › CVE-2026-116269
Go to dashboardMIME::Field::ParamVal before 5.521 for Perl decodes an RFC 2231 filename with a hyphenated language tag, such as en-US, to an empty string instead of the real filename. A mail filter that checks extensions on the recommended filename can then pass an executable attachment such as payload.exe.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams whose Perl code parses inbound MIME mail and uses recommended_filename() to decide whether an attachment is allowed, for example a mail gateway or scanner built on Perl. Code that does not read attachment names from mail, or that already uses a different filename source, is not exposed by this flaw.
No product ranges from the sources yet.
perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION' or cpanm --info MIME::Field::ParamVal to read the installed versionMIME::Field::ParamVal or MIME::Tools to find code that calls recommended_filename()5.521 or latername parameter when recommended_filename() returns an empty stringEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.
A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.
Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.
This page as .md · .json · in your agent: get_signal("CVE-2026-116269")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.