https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 08:37:02 +0000 https://db.gcve.eu/vuln/cve-2026-116271 <p><strong>Affected:</strong> MIME-tools</p> <p>MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.</p> <p>Each message is written to a directory named msg-&lt;time&gt;-&lt;pid&gt;-&lt;n&gt; under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.</p> <p>When the output base is writable by other users, as with output_under(&#34;/tmp&#34;), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.</p> <p><strong>Affected:</strong> MIME-tools</p> <p>MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.</p> <p>Each message is written to a directory named msg-&lt;time&gt;-&lt;pid&gt;-&lt;n&gt; under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.</p> <p>When the output base is writable by other users, as with output_under(&#34;/tmp&#34;), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.</p> https://db.gcve.eu/vuln/cve-2026-116271