CVE-2026-120640: CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields

Q: Which applications are exposed to a practical cross-site request forgery attack?

Applications using affected Perl CGI versions are exposed if they read JSON or another request body through param('POSTDATA'), param('PUTDATA'), param('PATCHDATA'), or param('XForms:Model') and treat that value as the genuine request body. A browser can supply a conflicting value in a cross-site HTML form.

Q: Does exploitation require CORS permission or a preflight request?

No. The described attack uses a cross-site HTML form posting a value such as POSTDATA={"admin":true}, and it does not require a CORS preflight.

Q: How can I identify vulnerable request handling in an application?

Review code for reads of POSTDATA, PUTDATA, PATCHDATA, or XForms:Model through CGI parameter access, especially param(). Such code is vulnerable when it relies on those parameters to distinguish the actual non-form or XForms request body from client-supplied form or query-string values.

Q: What version boundary is provided for remediation?

The issue affects CGI versions before 5.00 for Perl. CGI 5.00 is the stated fixed version boundary.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields.

CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from the query string, a form field or a multipart part, so an application cannot tell a client-sent value from the real body.

A cross-site HTML form can post POSTDATA={"admin":true} to an endpoint that reads JSON from param('POSTDATA'), a request forgery that needs no CORS preflight.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:40 PM

DescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

Affected Software

Frequently Asked Questions

Which applications are exposed to a practical cross-site request forgery attack?

Applications using affected Perl CGI versions are exposed if they read JSON or another request body through param('POSTDATA'), param('PUTDATA'), param('PATCHDATA'), or param('XForms:Model') and treat that value as the genuine request body. A browser can supply a conflicting value in a cross-site HTML form.

Does exploitation require CORS permission or a preflight request?

No. The described attack uses a cross-site HTML form posting a value such as POSTDATA={"admin":true}, and it does not require a CORS preflight.

How can I identify vulnerable request handling in an application?

Review code for reads of POSTDATA, PUTDATA, PATCHDATA, or XForms:Model through CGI parameter access, especially param(). Such code is vulnerable when it relies on those parameters to distinguish the actual non-form or XForms request body from client-supplied form or query-string values.

What version boundary is provided for remediation?

The issue affects CGI versions before 5.00 for Perl. CGI 5.00 is the stated fixed version boundary.

CVE-2026-120640: CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to a practical cross-site request forgery attack?

Does exploitation require CORS permission or a preflight request?

How can I identify vulnerable request handling in an application?

What version boundary is provided for remediation?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to a practical cross-site request forgery attack?

Does exploitation require CORS permission or a preflight request?

How can I identify vulnerable request handling in an application?

What version boundary is provided for remediation?