CVE-2026-116271
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-116271 is a moderate vulnerability affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes. Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link. When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
Attack Chain
Attacker scans for vulnerable versions using version banners or PoC scanners
Attacker triggers CVE-2026-116271 vulnerability with a crafted request or payload
Vulnerability exploited to perform unauthorized actions on the target system
Depending on vulnerability type, attacker achieves data access, service disruption, or code execution
MITRE ATT&CK Techniques
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against application endpoint — monitor access logs for anomalous params |
Remediation
Quick Facts
| CVE ID | CVE-2026-116271 |
| CVSS Score | N/A |
| Published | 2026-10-28 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |