by Kastro
Paper/Archive/CVE-2026-120642

CVE-2026-120642

CPANSec — CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
29
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 8.8.088 × 201.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

Affected

ProductAffectedFixed inSource
CGI< 5.005.00CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupmetacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pmrefmetacpan.org/release/LEEJO/CGI-5.00/changespatchgithub.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch