CVE-2026-120641: CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

Q: What conditions are required for exploitation?

An attacker must be able to submit a multipart file upload and the application must save the uploaded file using the filename returned by CGI without sanitizing or replacing path components. The attacker can supply traversal sequences or Windows-style paths in the upload part's Content-Disposition filename parameter.

Q: Are all applications using affected CGI versions vulnerable?

No. The issue becomes exploitable when an application uses the returned upload filename as a filesystem path or as part of one without safely restricting it to the intended upload directory. Applications that generate their own filenames or sanitize and validate supplied names are not exposed through this behavior.

Q: What can be done before upgrading?

Do not use the client-provided upload filename as a storage path. Generate server-side filenames, or strictly remove path components and reject traversal and platform-specific path syntax before writing files.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths.

The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged.

An application that saves the upload under this name can be made to write outside the intended directory.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to submit a multipart file upload and the application must save the uploaded file using the filename returned by CGI without sanitizing or replacing path components. The attacker can supply traversal sequences or Windows-style paths in the upload part's Content-Disposition filename parameter.

Are all applications using affected CGI versions vulnerable?

No. The issue becomes exploitable when an application uses the returned upload filename as a filesystem path or as part of one without safely restricting it to the intended upload directory. Applications that generate their own filenames or sanitize and validate supplied names are not exposed through this behavior.

What can be done before upgrading?

Do not use the client-provided upload filename as a storage path. Generate server-side filenames, or strictly remove path components and reject traversal and platform-specific path syntax before writing files.

CVE-2026-120641: CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required for exploitation?

Are all applications using affected CGI versions vulnerable?

What can be done before upgrading?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Are all applications using affected CGI versions vulnerable?

What can be done before upgrading?