Quick answers
- Is CVE-2026-116271 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116271 being exploited in the wild.
- How severe is CVE-2026-116271?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- Perl MIME-tools before 5.521.
- Is there a fix for CVE-2026-116271?
- Yes: fixed in MIME-tools 5.521. Until then: Avoid using output_under() with world-writable directories like /tmp; use a directory writable only by the parsing process. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116271 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-116271?
- Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: MIME-tools 5.521
Avoid using output_under() with world-writable directories like /tmp; use a directory writable only by the parsing process.
Technical details
MIME::Parser::FileUnder reuses existing directories named msg-<time>-<pid>-<n> and treats dangling symlinks within them as unused file slots, opening attachment files in a way that follows the symlink. An attacker with write access to the output base directory can pre-create the directory with a symlink pointing to an arbitrary path, causing the parser to write attachments with the privileges of the parsing process.
Affected products
- Perl MIME-tools before 5.521
Timeline
- 2026-10-28: disclosed
- 2026-10-27: patched