MIME::Field::ParamVal versions before 5.521 for Perl incorrectly handle RFC 2231 filenames with hyphenated language tags, resulting in an empty recommended filename. This occurs because the decoder fails to strip the language suffix when it contains hyphens, causing the recommended_filename() method to return an empty string instead of the actual filename. This behavior differs from other mail readers that correctly return the filename. Consequently, a remote sender can bypass file extension checks on the recommended filename, potentially allowing disallowed attachments to be delivered.