{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-116271 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-116271 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-116271 is a vulnerability, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-116271 and fix it if it is affected.\n\nWhat it is: CVE-2026-116271 is a vulnerability, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-116271 in the wild and no public exploit code.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-116271/ (Markdown: https://insights.sbomify.com/CVE-2026-116271/index.md)","id":"CVE-2026-116271","markdown":"https://insights.sbomify.com/CVE-2026-116271/index.md","name":"CVE-2026-116271","record":{"aliases":["DEBIAN-CVE-2026-116271","GHSA-x3mf-3f47-pgpf","UBUNTU-CVE-2026-116271"],"analysis":null,"analysis_generated_by":null,"assigner":"CPANSec","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-\u003ctime\u003e-\u003cpid\u003e-\u003cn\u003e under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users r","id":"CVE-2026-116271","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment.","id":"CVE-2026-116272"},"packages":[],"prev":{"headline":"MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated \"=?\" sequences in decode_mimewords","id":"CVE-2026-116270"},"products":[],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":[]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-116271/"}