DEBIAN-CVE-2026-120642: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires from 4.67 on. These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks unvalidated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI for Perlto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CGI versions before 5.00 under Perl taint mode are exposed if they consume the affected request-derived values and rely on Perl's taint checks to require validation before sensitive use.
What attacker-controlled inputs can bypass taint-mode checks?
Affected values include upload filenames, uploadInfo values, some path_info and script_name values, Accept results, and parameter or cookie name lists returned by url_param and cookie. In version 4.67 and later, a cookie named expires is also returned untainted.
What must an attacker do to exploit this behavior?
An attacker must be able to supply an affected HTTP request value that the application later uses in a security-sensitive operation while relying on Perl -T checks to reject tainted input. The issue allows those values to pass taint checks without validation.
How can I determine whether an application may be affected?
Check whether it uses a CGI version earlier than 5.00 with Perl taint mode enabled, and review uses of the listed CGI return values. Applications are at risk where those values reach sensitive operations without independent validation or sanitization.