DEBIAN-CVE-2026-120640: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields. CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under XForms:Model, but also accepts these names from the query string, a form field or a multipart part, so an application cannot tell a client-sent value from the real body. A cross-site HTML form can post POSTDATA={"admin":true} to an endpoint that reads JSON from param('POSTDATA'), a request forgery that needs no CORS preflight.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI for Perlto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
What application patterns are exposed to this issue?
Applications are exposed if they use CGI parameter lookups such as param('POSTDATA') to read a request body or otherwise rely on POSTDATA, PUTDATA, PATCHDATA, or XForms:Model to distinguish the actual request body from client-supplied parameters. This is particularly relevant for endpoints that accept JSON or other non-form bodies through these parameter names.
What does an attacker need to exploit it?
An attacker can supply one of the affected names in a query string, form field, or multipart part. The described cross-site scenario uses an HTML form posting POSTDATA={"admin":true} to an endpoint that reads param('POSTDATA'), and does not require a CORS preflight.
How can I determine whether an application may already be vulnerable?
Review CGI applications for reads of POSTDATA, PUTDATA, PATCHDATA, or XForms:Model through parameter APIs, especially param('POSTDATA'). Test whether supplying one of those names in the query string or form data can be accepted in place of, or confused with, the real request body.