Medium [CVE-2026-116271] Arbitrary file overwrite via symbolic link following

MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg--- under the output base, and an existing directory of that name is used as is.

A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment.

The parser then writes the attachment to the link target with the privileges of the parsing process. A flaw was found in perl-mime-tools.

This vulnerability allows a local attacker to overwrite arbitrary files with the permissions of the application process. When the parser writes message attachments into a shared or world-writable directory, an attacker can pre-create the expected output directory containing symbolic links (file shortcuts) targeting sensitive files.

Consequently, the parser follows these links when writing attachment data, potentially leading to unauthorized data modification or privilege escalation. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).

Weakness: CWE-59.