CVE-2026-120646 Details
Description
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.
A denial-of-service vulnerability has been identified in CGI.pm versions 4.71 prior to 5.00 for Perl. The issue arises in the uploadInfo() method, which improperly dereferences plain strings as symbolic references. This flaw allows a client to crash an application by sending a string that references a defined global variable, such as '0', which is interpreted as a symbolic reference. The method then dies when attempting to call a filename method on the string, without verifying that it is an upload filehandle.
Users are advised to upgrade to CGI.pm version 5.00 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/a14a7decfdc18f2daf436d30df9b543e3f0f8da3.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | BundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI | >= 4.71, < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |