Cross-Site Request Forgery in CGI for Perl Versions Prior to 5.00
CVE-2026-120640

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120640?

CGI for Perl versions prior to 5.00 exposes a vulnerability that allows attackers to manipulate the POSTDATA, PUTDATA, PATCHDATA, and XForms:Model parameters via the query string or form fields. This flaw permits an attacker to construct a malicious cross-site HTML form that can send arbitrary JSON data, thereby tricking the application into processing unauthorized requests without proper validation. As a result, the application may inadvertently trust client-sent data, leading to potential exploitation and unauthorized access.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/bc4022f553301014e5...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.