---
id: "CVE-2026-116269"
kind: "vulnerability"
aliases: ["CVE-2026-116269"]
title: "Perl MIME::Field::ParamVal: hyphenated RFC 2231 language tag hides attachment filename"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email-security", "mail-gateway", "package", "perl"]
not_affected_if: ["filename-not-used-for-policy", "no-mime-parsing"]
published_at: "2026-10-28T18:17:13+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116269", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Perl MIME::Field::ParamVal: hyphenated RFC 2231 language tag hides attachment filename

MIME::Field::ParamVal before 5.521 for Perl decodes an RFC 2231 filename with a hyphenated language tag, such as en-US, to an empty string instead of the real filename. A mail filter that checks extensions on the recommended filename can then pass an executable attachment such as payload.exe.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `perl -MMIME::Field::ParamVal -e 'print $MIME::Field::ParamVal::VERSION'` or `cpanm --info MIME::Field::ParamVal` to read the installed version
- Search dependencies for `MIME::Field::ParamVal` or `MIME::Tools` to find code that calls `recommended_filename()`

## Fix

- Upgrade MIME::Field::ParamVal to `5.521` or later
- Where a filter depends on the attachment name, fall back to the `name` parameter when `recommended_filename()` returns an empty string

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116269

## From the sources

MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.

A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.

Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_