Input Validation Flaw in CGI for Perl Affects Multiple Versions
CVE-2026-120642

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120642?

In CGI versions prior to 5.00 for Perl, request-derived values are returned without proper validation even when taint mode is enabled. This oversight allows critical request data—such as upload filenames, uploadInfo values, and parameters from URL and cookies—to bypass necessary security checks. Specifically, values derived from regex captures or hash keys are not marked as tainted by Perl's taint mode, resulting in unverified input being processed. Consequently, this can lead to potential security implications if exploited.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.