{"schema":"threatline.record/2","record":{"id":"CVE-2026-116269","aliases":[],"summary":"MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename","details":"MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename.\n\nA parameter such as filename*=utf-8'en-US'payload.exe is converted to an encoded word with the language tag appended to the charset. The decoder strips the language suffix only when it is a single word, so it cannot resolve the charset UTF-8*EN-US and returns an empty string. The recommended_filename() method returns that empty string rather than falling back to the name parameter.\n\nOther mail readers return payload.exe. A remote sender can get an attachment past a policy that checks file extensions on the recommended filename.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116269","source_modified_at":"2026-10-28T17:33:22.332Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":null,"vendor":null,"versions":[{"lessThan":"5.521","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116269","source_modified_at":"2026-10-28T17:33:22.332Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":null,"ecosystem":null},"version":"5.521","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T17:33:22.332Z","modified_at":"2026-10-28T17:33:22.332Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116269","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T17:33:22.332Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://metacpan.org/release/DSKOLL/MIME-tools-5.521/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T17:33:22.332Z","content_hash":"010d3bdae83273b5e6da987a6690d328e6fac55ccb7192b4abd7e32f8bb3335d"}}