CVE-2026-116271 in Mime Parser
Summary
by MITRE • 10/28/2026
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.
Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.
When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in MIME::Parser versions prior to 5.521 for Perl represents a critical file system manipulation flaw rooted in improper handling of directory structures and symbolic links during email processing operations. This issue falls under the category of CWE-59, which describes Improper Link Resolution Before File Access, commonly known as a symlink following vulnerability. The core technical defect lies in the parser's logic when determining where to store incoming message attachments. Specifically, the module creates or utilizes directories named with a pattern combining timestamp and process identifier variables for each processed message. Crucially, if a directory with this generated name already exists within the designated output base path, the parser does not verify its contents or integrity but instead reuses it directly without checking for malicious modifications such as symbolic links.
The operational mechanism of this flaw exploits the behavior of standard file system operations on Linux and Unix-like systems where dangling symlinks are often treated as non-existent paths by certain application logic that checks for existence before writing. In the context of MIME::Parser, a path is considered available if no regular file exists at that specific location. However, a symbolic link pointing to an arbitrary target elsewhere in the filesystem does not constitute a blocking existing file from the perspective of simple existence checks. Consequently, when the parser opens a new body file for writing within this pre-existing directory containing such a symlink, it follows the link and writes data directly into the target destination defined by the attacker-controlled symbolic link rather than creating a new file in the intended safe location.
This behavior becomes particularly dangerous when the output base directory is writable by unprivileged users or other processes on the system, which is a common configuration for temporary directories such as /tmp used via functions like output_under("/tmp"). In this scenario, an attacker with local access can pre-create the specific directory structure expected by the parser and populate it with symbolic links pointing to sensitive files owned by privileged services or other users. When the vulnerable application processes a maliciously crafted email containing attachments that trigger the creation of these directories, the resulting write operation is redirected away from the temporary space and into the target file system locations specified by the symlinks. This allows local attackers to overwrite arbitrary files with the privileges of the process running MIME::Parser, potentially leading to privilege escalation if a privileged service relies on this module for email processing.
The impact of this vulnerability extends beyond simple data corruption or denial of service. By controlling where attachment writes occur, an attacker can manipulate configuration files, inject malicious code into executable scripts, or overwrite critical system binaries depending on the permissions and context of the parsing process. If the application runs with elevated privileges to handle sensitive email workflows, this symlink following flaw effectively becomes a local privilege escalation vector. The lack of atomicity in directory creation and the failure to validate that the output path is strictly within the intended sandboxed area are fundamental design oversights that undermine the security boundary between untrusted input data and system resources.
To mitigate this vulnerability, organizations must upgrade MIME::Parser to version 5.521 or later where these logic flaws have been addressed by implementing stricter validation of directory contents and ensuring that new directories are created atomically without reusing potentially compromised existing paths. Additionally, application developers should enforce strict output base configurations that avoid world-writable temporary directories like /tmp unless absolutely necessary, opting instead for private temporary directories with restricted permissions owned exclusively by the service account. Implementing file system access controls such as SELinux or AppArmor can also provide an additional layer of defense by restricting where specific processes are allowed to write files regardless of application-level logic errors. Regular auditing of email processing modules and adherence to secure coding standards that mandate validation of all external inputs affecting file paths are essential practices for maintaining robust security postures against path traversal and symlink attacks.