MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.
A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.
Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.
GHSA-h2xx-9xmf-ppmv
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated...
https://github.com/advisories/GHSA-h2xx-9xmf-ppmvMIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.
A parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.
Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.
Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116269",
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"dateUpdated": "2026-10-28T17:33:22.332Z",
"dateReserved": "2026-10-25T18:05:02.236Z",
"datePublished": "2026-10-28T17:33:22.332Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec",
"dateUpdated": "2026-10-28T17:33:22.332Z"
},
"title": "MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename",
"descriptions": [
{
"lang": "en",
"value": "MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.\n\nA parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.\n\nOther mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename."
}
],
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"packageName": "MIME-tools",
"modules": [
"MIME::Field::ParamVal"
],
"programFiles": [
"lib/MIME/Field/ParamVal.pm",
"lib/MIME/WordDecoder.pm",
"lib/MIME/Head.pm"
],
"programRoutines": [
{
"name": "MIME::Field::ParamVal::parse_params"
},
{
"name": "MIME::WordDecoder::decode"
},
{
"name": "MIME::Head::recommended_filename"
}
],
"repo": "https://salsa.debian.org/dskoll/mime-tools",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "custom",
"lessThan": "5.521"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-436 Interpretation Conflict",
"cweId": "CWE-436",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes",
"tags": [
"release-notes"
]
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to MIME-tools 5.521 or later."
}
]
}
}
}