CVE-2026-116269— MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename

Quick assessment

Affected

CVE-2026-116269

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 MIME::Field::ParamVal 模块在 5.521 版本之前，会将带有连字符语言标签的 RFC 2231 文件名转换为空的推荐文件名。例如，形如的参数会被转换成一个编码词，其中语言标签被附加到字符集之后。解码器仅在语言后缀为单个单词时才会将其剥离，因此无法解析这一字符集，最终返回空字符串。方法直接返回该空字符串，而非回退到参数。其他邮件客户端则能正确返回。远程发送者可借此绕过基于推荐文件名检查文件扩展名的安全策略，从而将附件成功送达。

AI Predicted 5.5 Difficulty: Easy EPSS 0.18% · P7 Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1566.001 · Spearphishing Attachment T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 5.521`	affected

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename

Source: CVE Program / CVE List V5

Vulnerability Description

MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename. A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter. Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

解释冲突

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 5.521	-

II. Public POCs for CVE-2026-116269

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116269

请登录查看更多情报信息。

Other References for CVE-2026-116269 (1)

https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes release-notes

https://www.cve.org/CVERecord?id=CVE-2026-116269

IV. Related Vulnerabilities

Same weakness: CWE-436