CVE-2026-120642: CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

Q: Which applications are exposed to this issue?

Perl applications using CGI versions earlier than 5.00 are affected when they rely on Perl taint mode (-T) to reject untrusted request data. Exposure is limited to code that consumes the listed CGI-returned values and treats their untainted status as validation.

Q: What attacker-controlled inputs can bypass taint-mode checks?

The affected values include upload filenames, uploadInfo values, certain path_info and script_name values, Accept results, and name lists returned by url_param and cookie. A cookie named expires is also affected in versions from 4.67 onward.

Q: What should be done if the application cannot be upgraded immediately?

Do not rely on the taint flag for the affected CGI return values. Explicitly validate and sanitize these values before using them in security-sensitive operations.

Q: How can I determine whether my application is affected?

Check whether it uses a CGI version earlier than 5.00 and runs with taint mode enabled. Then identify uses of the affected return values where code relies on Perl's taint checks rather than performing explicit validation.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.

The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on.

These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Perl applications using CGI versions earlier than 5.00 are affected when they rely on Perl taint mode (-T) to reject untrusted request data. Exposure is limited to code that consumes the listed CGI-returned values and treats their untainted status as validation.

What attacker-controlled inputs can bypass taint-mode checks?

The affected values include upload filenames, uploadInfo values, certain path_info and script_name values, Accept results, and name lists returned by url_param and cookie. A cookie named expires is also affected in versions from 4.67 onward.

What should be done if the application cannot be upgraded immediately?

Do not rely on the taint flag for the affected CGI return values. Explicitly validate and sanitize these values before using them in security-sensitive operations.

How can I determine whether my application is affected?

Check whether it uses a CGI version earlier than 5.00 and runs with taint mode enabled. Then identify uses of the affected return values where code relies on Perl's taint checks rather than performing explicit validation.

CVE-2026-120642: CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What attacker-controlled inputs can bypass taint-mode checks?

What should be done if the application cannot be upgraded immediately?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What attacker-controlled inputs can bypass taint-mode checks?

What should be done if the application cannot be upgraded immediately?

How can I determine whether my application is affected?