{"id":"CVE-2026-116271","published":"2026-10-28T18:17:13.580","lastModified":"2026-10-28T18:17:13.580","description":"MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.\n\nEach message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.\n\nWhen the output base is writable by other users, as with output_under(\"/tmp\"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}