Path Traversal Vulnerability in CGI for Perl Affects Multiple Versions

CVE-2026-120641

What is CVE-2026-120641?

The CGI module for Perl, specifically versions prior to 5.00, is affected by a significant path traversal vulnerability. This issue arises when the module returns upload filenames that include client-supplied paths. As a result, malicious users can exploit this flaw to upload files with unintended paths, including escaping the intended directory structure (for example through ../ sequences) or utilizing Windows-specific paths. If applications save these uploads without sanitizing the filenames, they may write files in unauthorized locations on the server, potentially leading to further exploitation or data breaches.

References