CVE-2026-116271 MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users r
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116271?
CVE-2026-116271 is a vulnerability, published on 28 Oct 2026.
Official description
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.
Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.
When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
Weakness: CWE-59
Which versions are affected by CVE-2026-116271?
How do I fix CVE-2026-116271?
No fix has been published for CVE-2026-116271 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116271 being exploited?
There is no known exploitation of CVE-2026-116271 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116271, GHSA-x3mf-3f47-pgpf, UBUNTU-CVE-2026-116271.