UBUNTU-CVE-2026-120648: Medium severity ubuntu/libcgi-pm-perl vulnerability

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment. Arguments are placed between  without escaping, so text containing --> closes the comment early. An application that passes request data to comment can be made to inject HTML into the page.

Affected Software

7 affected components

ubuntu/libcgi-pm-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Perl CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker control to exploit this issue?

The attacker must be able to supply request data, or other application-controlled text, that is passed to CGI's comment handling. The supplied text must contain --> to terminate the HTML comment early and inject markup into the page.

Are applications affected by default merely because libcgi-pm-perl is installed?

No. Exploitation depends on an application placing untrusted data into CGI-generated HTML comments. The provided information does not indicate that installation alone exposes an application.

What can be done if an update cannot be applied immediately?

Avoid passing request-derived or otherwise untrusted text to CGI comment handling. Where such use cannot be removed, reject or sanitize values containing --> before they are included in a comment.

UBUNTU-CVE-2026-120648: Medium severity ubuntu/libcgi-pm-perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What must an attacker control to exploit this issue?

Are applications affected by default merely because libcgi-pm-perl is installed?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker control to exploit this issue?

Are applications affected by default merely because libcgi-pm-perl is installed?

What can be done if an update cannot be applied immediately?