DEBIAN-CVE-2026-120647: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
What applications are realistically exposed to this issue?
Applications using CGI versions before 5.00 are exposed if they pass request-controlled data into header(-attachment => $name). The issue applies specifically when that value is used as the Content-Disposition attachment filename.
What does an attacker need to exploit it?
An attacker needs influence over the attachment name supplied to header(-attachment => $name). By including an unescaped double quote, they can inject a second filename parameter and alter the filename used when the response is saved.
What can be done if an upgrade is not immediately possible?
Do not pass request data directly as the attachment name. Reject or remove double quotes from attachment filename values before calling header(-attachment => $name).
How can I identify potentially affected code?
Review code for calls to header(-attachment => $name), especially where $name is derived from request parameters or other untrusted input. Deployments using CGI versions before 5.00 with such data flow are potentially affected.