CVE-2026-120642 Details
Description
CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.
A vulnerability exists in CGI.pm versions prior to 5.00 for Perl, where request-derived values are returned untainted in taint mode. This issue affects several parameters, including upload filenames, header values from the uploadInfo() method, path_info and script_name values derived from the REQUEST_URI, certain cookie values, and names from url_param and cookie() methods. The vulnerability arises because these values, extracted through regex captures or hash keys, bypass Perl's tainting mechanism, evading -T safety checks. Exploitation could lead to unvalidated data being processed by the application, potentially causing harmful effects, especially if the data is used in system calls or file operations.
Users are advised to upgrade to CGI.pm version 5.00 or later, where this vulnerability has been addressed. In the meantime, be cautious with file uploads and validate all request-derived values before use.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1173 | Improper Use of Validation Framework | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI | < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |