DEBIAN-CVE-2026-120641: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can be made to write outside the intended directory.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using CGI versions before 5.00 are exposed if they save uploaded files using the filename returned by CGI. The risk applies when that returned value is used as the destination name without preventing path components from affecting the save location.
What does an attacker need to do to exploit it?
An attacker needs to submit an uploaded file whose multipart Content-Disposition filename parameter contains a path, such as ../ or a Windows-style path. CGI returns that client-supplied value unchanged.
What can be done if upgrading is not immediately possible?
Do not save uploaded files under the filename returned by CGI unchanged. Ensure client-supplied upload names cannot determine a path outside the intended upload directory.
How can I determine whether an application is affected?
Check whether it uses a CGI version before 5.00 and whether it uses the upload filename returned by CGI when saving files. The affected behavior is returning the Content-Disposition filename parameter unchanged.