CVE-2026-120647: CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

Q: Which applications are exposed to this issue?

Applications using a CGI version before 5.00 are exposed if they pass request-controlled data to header(-attachment => $name). The issue is relevant where that value can contain an unescaped double quote.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename.

header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes.

An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:41 PM

Data Sourced

via MITRE·11:41 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using a CGI version before 5.00 are exposed if they pass request-controlled data to header(-attachment => $name). The issue is relevant where that value can contain an unescaped double quote.

What does an attacker need to exploit it?

An attacker needs control over the attachment filename value supplied to header(-attachment => $name), directly or through request data accepted by the application. By including a double quote, they can inject a second filename parameter into the Content-Disposition header.

Are default deployments affected?

The vulnerable behavior exists in CGI versions before 5.00, but exploitation depends on application code using header(-attachment => $name) with request-derived attachment names. The provided information does not establish that a default application configuration supplies attacker-controlled data to this parameter.

What can be done if upgrading is not immediately possible?

Do not pass request-controlled values directly as attachment names. Reject or remove double quotes from any attachment filename before providing it to header(-attachment => $name).

How can I determine whether an application is affected?

Review uses of header(-attachment => $name) and trace whether $name can be influenced by request data. Affected responses will place that value in the quoted filename parameter of the Content-Disposition header without escaping double quotes.

CVE-2026-120647: CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are default deployments affected?

What can be done if upgrading is not immediately possible?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to exploit it?

Are default deployments affected?

What can be done if upgrading is not immediately possible?

How can I determine whether an application is affected?