Paper/Archive/CVE-2026-120644

CVE-2026-120644

CPANSec — CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

EPSS 0.2%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 10.6.106 × 202.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Affected

ProductAffectedFixed inSource

CGI< 5.005.00CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupmetacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm refmetacpan.org/release/LEEJO/CGI-5.00/changes patchgithub.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch