Form Field Smuggling Vulnerability in CGI by Perl
CVE-2026-120635

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120635?

A vulnerability in the CGI module before version 5.00 for Perl allows attackers to smuggle form fields past security measures like proxies and web application firewalls (WAFs). This issue arises from improper multipart parsing where the parser incorrectly matches boundaries, uses client-supplied User-Agent strings without expected formatting, and mishandles Content-Disposition names and filenames. These flaws could lead to data corruption and information leakage, posing a significant security risk.

References

https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1
technical-description
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.