MIME Field Parameter Flaw in Perl Affecting MIME Tools
CVE-2026-116269

Currently unrated

Key Information:

Vendor

Perl

Status
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116269?

A vulnerability in MIME::Field::ParamVal for Perl versions before 5.521 allows crafted filenames using RFC 2231 encoding to bypass file extension checks. When a filename with a hyphenated language tag is processed, the method fails to correctly decode the charset, leading to an empty recommended filename. This issue permits remote attackers to potentially circumvent security policies that rely on filename validation, allowing malicious files to be transmitted undetected.

References

https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.