Content-Disposition Parameter Injection in CGI for Perl by LEEJO
CVE-2026-120647

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120647?

The CGI for Perl versions prior to 5.00 has a vulnerability that allows for Content-Disposition parameter injection due to improper handling of unescaped double quotes in attachment filenames. This can occur when the application processes request data as the attachment name, permitting an attacker to manipulate the filename parameter and potentially change how the response is saved. Users are recommended to upgrade to version 5.00 or later to mitigate this issue.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/131280a5c5bc51b657...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.