Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116271— MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes

Quick assessment

Affected
CVE-2026-116271
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言下的 MIME::Parser::FileUnder 模块在 5.521 版本之前存在安全漏洞：该模块会复用预先创建的输出目录，并遵循其中的符号链接，从而允许本地用户重定向附件的写入路径。 具体而言，每条消息会被写入到输出基目录下名为 的目录中；若该目录已存在，则直接复用。系统仅当指定路径下没有任何文件时，才认为该文件名“未使用”——而悬空符号链接（dangling symlink）即满足此条件。因此，模块在打开正文文件时会遵循该符号链接。 当输出基目录对其他用户可写（例如使用 时），本地攻击者可预先

AI Predicted 6.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1574 · Hijack Execution Flow

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 5.521 affected

I. Basic Information for CVE-2026-116271

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes
Source: CVE Program / CVE List V5
Vulnerability Description
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 5.521 -

II. Public POCs for CVE-2026-116271

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116271

请登录查看更多情报信息。

Other References for CVE-2026-116271 (1)

IV. Related Vulnerabilities

Same weakness: CWE-59