Local File Write Vulnerability in MIME Parser for Perl by DSKOLL

CVE-2026-116271

What is CVE-2026-116271?

The MIME::Parser::FileUnder component for Perl, before version 5.521, has a vulnerability that allows local users to manipulate outputs by reusing a pre-existing output directory. When a symlink is present, the parser can be tricked into redirecting attachment writes to an unintended location, potentially compromising sensitive data. This occurs when the output directory is writable by multiple users, enabling an attacker to pre-create directories with specific symlink names that correspond to attachment files, allowing them to gain unauthorized access to data.

References