{"id":"CVE-2026-116271","kind":"vulnerability","aliases":["CVE-2026-116271"],"related":[],"title":"Perl MIME::Parser: symlinks let local users redirect attachment writes","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","summary":"MIME::Parser::FileUnder before 5.521 reuses an existing output directory and opens files by following symlinks inside it. A local user who can write to a shared output base such as /tmp can make the parser write attachments to a file of their choosing, with the parsing process's privileges.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mime-tools","package","perl","self-hosted"],"not_affected_if":["no-mime-parser","private-output-dir"],"how_to_check":"- Find the Perl MIME-Tools version with `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'` and check whether it is below `5.521`\n- Check whether code calls `output_under` on a shared, world-writable directory such as `/tmp`","fix":"- Upgrade MIME-Tools (MIME::Parser) to `5.521` or later\n- Write output to a private directory that other users cannot write to, not `/tmp`","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:23+00:00","updated_at":"2026-10-28T18:35:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T18:35:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MIME-Tools (MIME::Parser) to `5.521` or later\n- Write output to a private directory that other users cannot write to, not `/tmp`","reach":"local","title":"Perl MIME::Parser: symlinks let local users redirect attachment writes","impact":"medium","summary":"MIME::Parser::FileUnder before 5.521 reuses an existing output directory and opens files by following symlinks inside it. A local user who can write to a shared output base such as /tmp can make the parser write attachments to a file of their choosing, with the parsing process's privileges.","category":"package","nicknames":[],"who_cares":["perl","mime-tools","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker redirects attachment writes to arbitrary files with parser privileges","analyst_note":"","how_to_check":"- Find the Perl MIME-Tools version with `perl -MMIME::Parser -e 'print $MIME::Parser::VERSION'` and check whether it is below `5.521`\n- Check whether code calls `output_under` on a shared, world-writable directory such as `/tmp`","needs_analyst":false,"not_affected_if":["private-output-dir","no-mime-parser"],"who_is_affected":"Teams that run Perl code using MIME::Parser::FileUnder with output_under pointing at a directory other local users can write to, such as /tmp. Parsing mail in a directory only the service user can write to removes the local symlink path. unknown whether the sources list any other exposure.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3441,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116271':13A,16A '-2026':12A,15A '/tmp':56B,170C '5.521':29B,80C 'attach':9A,62B,99C,186C,192C 'base':53B,113C,160C 'bodi':145C 'choos':68B 'count':128C 'creat':87C,177C 'cve':11A,14A 'dangl':141C 'directori':34B,89C,107C,117C,179C 'exist':32B,116C,133C 'file':37B,65B,126C,146C 'fileund':27B,77C 'follow':39B,91C,154C 'hold':138C 'host':24B 'insid':41B 'let':5A,95C 'like':184C 'link':156C,195C 'local':6A,44B,96C,172C 'make':58B 'messag':102C 'mime':2A,18B,25B,75C 'mime-tool':17B 'msg':109C 'name':108C,120C,127C,183C 'noth':132C 'open':36B,149C 'output':33B,52B,88C,112C,159C,168C 'packag':20B 'pars':71B,202C 'parser':3A,26B,60B,76C,188C 'path':136C 'perl':1A,21B,82C 'pre':86C,176C 'pre-creat':85C,175C 'privileg':74B,199C 'process':72B,203C 'redirect':8A,98C 'reus':30B,83C 'self':23B 'self-host':22B 'share':51B 'symlink':4A,40B,92C,142C,182C 'target':196C 'tool':19B 'unus':130C 'use':122C 'user':7A,45B,97C,165C,173C 'version':78C 'way':152C 'writabl':162C 'write':10A,48B,61B,100C,190C 'written':104C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Perl code using MIME::Parser::FileUnder with output_under pointing at a directory other local users can write to, such as /tmp. Parsing mail in a directory only the service user can write to removes the local symlink path. unknown whether the sources list any other exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116271","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116271","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}