========================================================================
CVE-2026-116271                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116271

   Distribution:  MIME-tools
       Versions:  before 5.521
       MetaCPAN:  https://metacpan.org/dist/MIME-tools
       VCS Repo:  https://salsa.debian.org/dskoll/mime-tools

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a
pre-created output directory and follow symlinks in it, letting local
users redirect attachment writes

Description
-----------
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a
pre-created output directory and follow symlinks in it, letting local
users redirect attachment writes.

Each message is written to a directory named msg-<time>-<pid>-<n> under
the output base, and an existing directory of that name is used as is.
A file name counts as unused when nothing exists at that path, which
holds for a dangling symlink, and the body file is then opened in a way
that follows the link.

When the output base is writable by other users, as with
output_under("/tmp"), a local user can pre-create the directory with a
symlink named like an attachment. The parser then writes the attachment
to the link target with the privileges of the parsing process.

Problem types
-------------
- CWE-59 Improper Link Resolution Before File Access ('Link Following')

Solutions
---------
Upgrade to MIME-tools 5.521 or later.

References
----------
https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes