CVE-2026-120635 Details
Description
CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.
A vulnerability in CGI.pm versions prior to 5.00 allows for the smuggling of form fields past proxies and Web Application Firewalls (WAFs) through improper multipart/form-data parsing. The parser matches boundaries anywhere in the body instead of at the start of a line, uses boundaries without the required leading dashes for certain User-Agent values, and incorrectly finds Content-Disposition names and filenames within quoted values of other parameters. This flaw can corrupt data when boundaries approach the 4096-byte read limit.
Users are advised to upgrade to CGI.pm version 5.00 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch | CPANSec | Source CodeVendor |
| https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch | CPANSec | Source CodeVendor |
| https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch | CPANSec | Source CodeVendor |
| https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | CPANSec | Source Code |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | BundleRelease NotesVendor |
| https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1 | CPANSec | Not ApplicableRFC |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-436 | Interpretation Conflict | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI | < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |