CVE-2026-116269: MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename
MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.
A parameter such as filename=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8EN-US and returns an empty string. The recommendedfilename() method returns that empty string rather than falling back to the name parameter.
Other mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MIME-toolsto a version that resolves this vulnerability.Fixed in 5.521
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using MIME::Field::ParamVal before version 5.521 are exposed if they use recommended_filename() to enforce attachment filename-extension policies on remotely supplied email or MIME content.
What does an attacker need to send to trigger the problem?
The attacker needs to provide an RFC 2231 filename parameter with a hyphenated language tag, such as filename*=utf-8'en-US'payload.exe. This causes recommended_filename() to return an empty string instead of the supplied filename.
Are all attachment filename checks affected?
No. The described bypass applies specifically to policies that check extensions using the recommended filename returned by recommended_filename(). Other mail readers may resolve the same parameter as payload.exe.
What can be done before upgrading?
Do not treat an empty recommended filename as safe or as a reason to skip filename-extension enforcement. Ensure attachment handling accounts for the original RFC 2231 filename parameter and rejects or quarantines malformed or unresolved filename encodings.