CGI Vulnerability in Perl Affects Multiple Versions
CVE-2026-120637

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120637?

The identified vulnerability in CGI versions prior to 5.00 for Perl allows the exploitation of request parameters via command line arguments when an unrecognized REQUEST_METHOD is encountered. In scenarios where the REQUEST_METHOD is set to OPTIONS, the CGI module mistakenly engages its offline debugging mode, which is enabled by default. This defect can lead to the inappropriate construction of parameters and path information, potentially compromising the security of the application and exposing sensitive data.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/b753ff75a3bc4554c0...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.