DEBIAN-CVE-2026-120646: Debian/libcgi-pm-perl vulnerability
CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo. uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An application must call uploadInfo with attacker-controlled input that is a plain string naming a defined global variable. The example provided is an upload parameter value of 0 supplied through ?upload=0.
Which deployments are exposed?
Perl CGI versions from 4.71 before 5.00 are affected when their applications use uploadInfo on unvalidated request input. The provided data does not establish whether any particular application uses this method by default.
What is the impact of successful exploitation?
The uploadInfo call dereferences the string as a symbolic reference and invokes filename without confirming it is an upload filehandle. This causes the method call to die, resulting in denial of service.