AZL-112780: CVE-2026-120647 affecting package perl-CGI 4.60-1

Q: What conditions are required for exploitation?

An application must pass attacker-controlled request data as the attachment name to CGI's header(-attachment => $name). The attacker needs to supply a value containing an unescaped double quote so an additional filename parameter can be injected into the Content-Disposition header.

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.

header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.

An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.

Affected Software

1 affected component

azure-linux/perl-cgi<=4.60-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade perl-CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

Advisory Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-120647

Frequently Asked Questions

What conditions are required for exploitation?

An application must pass attacker-controlled request data as the attachment name to CGI's header(-attachment => $name). The attacker needs to supply a value containing an unescaped double quote so an additional filename parameter can be injected into the Content-Disposition header.

Are applications using perl-CGI affected by default?

The issue is only described for applications that use header(-attachment => $name) with untrusted input as the attachment filename. The provided data does not indicate that ordinary use of perl-CGI without attacker-controlled attachment names is affected.

What is the impact of successful exploitation?

An attacker can cause the response to include a second filename parameter in Content-Disposition. This can change the filename under which the response is saved.

AZL-112780: CVE-2026-120647 affecting package perl-CGI 4.60-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

Are applications using perl-CGI affected by default?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Are applications using perl-CGI affected by default?

What is the impact of successful exploitation?