MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| https://cpan.org/modules | MIME-tools |
< 5.521 |
5.521 |
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-116271 libmime-tools-perl
- Ubuntu UBUNTU-CVE-2026-116271 libmime-tools-perl
Original description The description as published by the source.
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.
Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.
When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web metacpan.org
- web nvd.nist.gov
- web github.com