HTTP::Body versions before 1.23_01 for Perl have a vulnerability where temporary files from incomplete multipart uploads are left on disk. The multipart parser creates temporary files when a file part starts but only tracks them if the part completes. If the upload ends prematurely inside a file part, the temporary file remains on disk untracked. This can be exploited by a remote attacker to fill the temporary directory with leftover files by sending repeated incomplete multipart requests.