CVE-2026-120635: CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs
CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.
The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI for Perlto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using CGI for Perl versions earlier than 5.00 and accepting multipart/form-data requests are exposed. The affected package identified here is debian/libcgi-pm-perl.
What does an attacker need to exploit the issue?
An attacker needs to send a crafted multipart/form-data request. The malformed multipart structure can be parsed differently by CGI for Perl than by an intermediary proxy or web application firewall.
Can a proxy or WAF prevent exploitation?
Not reliably if it interprets multipart boundaries or Content-Disposition parameters differently from the vulnerable parser. The issue specifically enables fields to be smuggled past such controls through parser discrepancies.
What should be done if an immediate upgrade is not possible?
No specific workaround is provided in the available data. Prioritize restricting or carefully validating multipart/form-data handling where possible, because the vulnerable parser behavior affects multipart boundary and Content-Disposition parsing.